AI governance for Mac: bringing AI under management

Somewhere in your organization, an engineer is running Claude Code. A few desks over, someone in finance is drafting in Claude Desktop. The decision to adopt AI has, in practice, already been made by the business and by people quietly getting more done with it.

Even if your organization standardized on a single platform like Microsoft Copilot, your developers are likely still using other tools without your knowledge.

Most security leaders we talk to want to say yes to AI adoption. And saying no doesn’t always give the results they’re expecting: It rarely makes a tool disappear. The tool keeps running on someone’s laptop with no policy behind it. So, the choice was never yes or no. It’s governed or ungoverned.

That’s the gap Jamf’s AI Governance capability closes. AI isn’t a threat to detect at the prompt. It’s software to manage. And on Mac, that software is far more configurable and far more unmanaged than most teams realize.

AI is managed software, and the controls just arrived.

Until very recently, these tools were built for individuals. Enterprise controls are new. Only recently have vendors started shipping enterprise-grade settings for AI harnesses like Claude Code, Claude Desktop and OpenAI Codex: model selection, file system access, MCP server connections and tools usage. The point of these settings is to let an organization decide what an AI agent can and can’t do before anyone types a prompt. And they’re still changing fast, at the speed AI itself moves.

Most teams are still working out how to use them. The settings live across config files in a mix of formats, and there can be dozens or hundreds of them per tool, shifting with every release. So, admins do it the hard way: reading documentation, testing by trial and error and hoping the result matches intent.

Meanwhile, security teams can’t reliably verify what’s deployed, and the CISO is asked to sign off on tools with little documentation behind them. When the board or an auditor asks, the honest answer today is often “we think we’re covered.”

That isn’t an AI problem. It’s a management problem, the same kind Jamf has solved for every other piece of software on the Mac for two decades. The tools are governable. The job now is making them easy to govern.

Get to yes faster

The slowest part of AI adoption is often approval. Security teams want evidence before it's deployed, and assembling that evidence by hand, across dozens or hundreds of settings per tool and every team that runs them, stalls rollouts for months.

Jamf’s AI Governance is built to shorten that. A vendor-aware policy builder turns each tool’s controls into plain-language options your AI, security, engineering or endpoint team can set without having to worry about understanding schemas. Sensible defaults let a team start from a vetted preset instead of a blank page, so a defensible posture is in place without making a hundred separate decisions first. From there, teams tune for their environment, scope by group and deploy.

These controls keep changing, so Jamf keeps watch for you. When a vendor adds, changes or retires a setting, Jamf surfaces it in the builder and explains what it does. This way, your team can decide how to handle it instead of finding out after something breaks and without chasing release notes across half a dozen tools. The result is a faster, cleaner path from “we’re evaluating this” to “this is approved and configured.”

Know what’s actually in your fleet

All of this assumes you know the tool is running in the first place, but you often don’t. AI tools don’t always show up in app inventories or on DNS logs like SaaS does. Claude Code runs as a CLI process; MCP servers run as background daemons. A networking tool like a CASB can see the AI connections, but not what the agent is doing on the local device. An EDR sees the process running, but not which model, what file-system scope or which MCP servers it can reach. You can’t govern what you can’t see, so endpoint visibility comes first.

Two inventory views ship alongside the policy builder. The AI Application Inventory surfaces every AI app, CLI harness, and tool invocation observed across the fleet, including higher-risk ones like SSH, osascript, and credential access. The MCP Server Inventory shows which MCP servers are running, what they expose, and which AI clients connect to them. Both are built on native Jamf endpoint telemetry, feed directly into the platform, and roll up into reporting.

Deployed through the plane you already run

Policies published in the builder are made available to your admins as Jamf blueprints through the device management plane your team already trusts.

The delivery mechanism is what makes this more than a config generator. The managed-settings file lands at the OS level, where the end user, the developer, and local processes can’t edit, remove, or replace it. And for the keys a policy sets, the supported tools treat managed settings as their highest-precedence layer. Not every preference behaves identically: Some are strictly enforced while others are centrally managed defaults. The builder provides the context so that you always know what you’re deploying and what to expect from it.

Evidence the board will accept

When leadership asks whether AI is under control, “I think so” isn’t an answer. The Governance Report is an on-demand single PDF that lays out every active policy across the fleet, including the tools governed and the controls in place.

That structure is deliberate. Boards and auditors want clear records and plain evidence. The report is built to produce exactly that, which turns the AI governance conversation from a matter of trust into a matter of record.

What Mac-native management makes possible

Enterprise AI adoption on Mac is moving fast. Engineering leaders are deploying Claude Code, Codex, Cursor, and Copilot across developer fleets. Knowledge workers are picking up Claude Desktop and Microsoft 365 Copilot across the business. These tools run natively on Apple silicon as CLI processes, background daemons, and desktop apps, and how they’re configured changes what they can do far more than whether they’re installed.

This is where Mac-native tooling matters. A deep understanding of the Endpoint Security API, visibility into apps and processes, and OS-level management are crucial for successful AI governance. Jamf treats AI as what it is: managed software with a real configuration surface, governed through the same first-party workflow IT already runs.

And if you do want to block an unsanctioned tool while you work through the decision, Jamf already does that elsewhere. AI Governance handles the part that comes after yes: running sanctioned tools inside the boundary you’ve set.

AI Governance is now available

Jamf's AI Governance is available now as part of Jamf for Mac, Jamf for Mac Hi-Ed, Business plan and Enterprise plan, starting with deep coverage of the tools teams are deploying most: Claude Code and Claude Cowork, alongside OpenAI Codex on AWS Bedrock. More tools will follow as their enterprise controls mature, including Cursor and GitHub Copilot for the teams standardized on Microsoft. And because Jamf already tracks vendor changes for you, adding them doesn’t mean waiting for the next big release.

For any organization with teams already running these tools on Mac, it’s the fastest path to a governance posture you can stand behind, built on the same workflow you use to manage everything else on the fleet.

AI Governance from day one

Here's a scenario that plays out every day for growing Mac fleets. A new hire joins the team. Their Mac ships directly to them, zero-touch. From the moment they open the lid, Jamf is already at work. Setup Manager walks them through onboarding, and Setup Checklist keeps them on track through each step. The device is automatically enrolled, configured and scoped to the correct blueprint for their role. The AI tools approved for their role are available from day one. The ones that aren't are already restricted. Network relay ensures that AI traffic routes correctly and securely from the start, reducing the risk of shadow AI before the employee has even opened their first ticket.

The new hire gets to the desktop faster. IT doesn't have to be in the room. That's what it looks like when governance is part of the platform — not bolted on after the fact.

Get your environment ready

The best use of your time before access is activated is getting the three key prerequisites in place. Here's what each one involves and why it matters.

1. Enable SSO with Jamf Account

OIDC authentication must be enabled in Jamf Pro, connecting your environment to Jamf Account via single sign-on. This is what ties your identity layer to the AI Governance controls so the right people can see and act on AI activity across your fleet, with access managed centrally through your existing identity provider.

If you haven't already set this up, it's worth doing now. It unlocks a cleaner admin experience across the board, not just for AI Governance.

See SSO with OIDC Through Jamf Account in the Jamf Account Documentation to get started.

2. Configure blueprints powered by Declarative Device Management

AI Governance uses blueprints, Jamf's configuration framework built on Apple's Declarative Device Management (DDM), to apply and enforce policies across your Mac fleet. You'll need Blueprints privileges in Jamf Pro (Create, Read, Update, Delete under Jamf Pro Server Objects) before access is activated.

If blueprints are new to your workflow, now is a great time to get familiar. DDM is now the standard for Apple device management, confirmed at WWDC 2026 where Apple engineer Cyrus Daboo put it plainly: "The standard for device management is declarative management." Devices check in with the server proactively rather than waiting to be polled, which means faster, more reliable policy enforcement at scale. AI Governance policies are delivered the same way, consistently, efficiently and without manual intervention.

3. Deploy the Jamf Protect agent

Jamf Protect's agent provides the Mac endpoint visibility that AI Governance relies on to detect and report AI activity. Without it deployed across your fleet, AI Governance has no signal to work with.

You can adopt as much of Jamf Protect as you need:

AI visibility only — Deploy Jamf Protect solely to feed AI activity data into AI Governance. If you're already running a third-party endpoint security tool and want to keep it as your primary solution, this lets you add Mac-native AI detection without disrupting your existing stack. Jamf Protect is purpose-built for Mac and designed to run alongside other endpoint security solutions.

Partial or full adoption — If you want to go further, Jamf Protect can also deliver telemetry, behavioral analysis and device controls alongside AI activity detection. Take what you need — whether that's one or two additional capabilities or the full suite. Most cross-platform security tools don't provide this depth for Apple endpoints, so you can fill exactly the gaps your stack has.

Jamf Protect System Extension

Jamf Protect runs as a macOS system extension by default, improving performance, stability and security. It's protected by Apple's System Integrity Protection (SIP), shielding it from tampering on managed computers.

The goal was never to keep AI out of the enterprise. It’s already in. The point is to govern it on purpose and have the record to prove it.