# Jamf Onboarding Overview

> End-to-end onboarding workflow for IT admins deploying thoth governance across managed macOS fleets with Jamf Pro.

Source: https://docs.atensecurity.com/docs/deployments/jamf-overview

Use this guide when your IT or security team is onboarding thoth governance across employee Macs managed by Jamf Pro.

**Audience:**
  This workflow is for your Jamf administrators and security engineers. Employees should not need to configure anything manually.

## What thoth changes on employee Macs

After onboarding:

- MCP tool calls from Claude Desktop are governed by thoth policy.
- Session intent controls are enforced.
- Endpoint behavior is visible through audit-ready telemetry.

Employee workflow in Claude Desktop should remain unchanged.

## Onboarding values from thoth

Your thoth onboarding provides:

- `tenant_id`
- `apex_domain`
- user identity mapping strategy for `THOTH_USER_ID` (must be valid email)

These values must be deployed through Jamf configuration, not hardcoded in scripts.

## Prerequisites checklist

- [ ] Release source selected and verified ([Release Channels + Verification](https://docs.atensecurity.com/docs/deployments/release-channels)).
- [ ] Jamf Pro permissions for scripts, packages, and policy assignments.
- [ ] thoth onboarding values are available and validated.
- [ ] Claude Desktop is already present on managed Macs.
- [ ] Node.js baseline is deployed to managed Macs.
- [ ] thoth binary baseline is deployed to managed Macs.

## Recommended Jamf policy model

Use three policies in sequence:

1. **Prerequisites policy**: install/verify `thoth`, `node`, and `npx`.
2. **Config policy**: deploy onboarding values.
3. **Setup policy**: wrap Claude Desktop config and enable governed runtime.

This model lets your team rotate onboarding values without rebuilding installation baselines.

## Jamf rollout pattern

Use staged scope:

1. Test smart group (1-5 devices)
2. Pilot smart group (5-15% of fleet)
3. Broad production rollout

Validate each stage with:

```bash
thoth health --json
thoth status
```

## Jamf runbooks

- [Jamf macOS Runbook](https://docs.atensecurity.com/docs/deployments/jamf-macos)
- [macOS Deployment Reference (Jamf)](https://docs.atensecurity.com/docs/deployments/macos-jamf)
- [Deployment Validation Matrix](https://docs.atensecurity.com/docs/deployments/validation-matrix)