> ## Documentation Index
> Fetch the complete documentation index at: https://docs.starfort.io/llms.txt
> Use this file to discover all available pages before exploring further.
# Desktop Agent settings
> Company-level Desktop Agent configuration: access key, fail-safe behavior, and the unassigned default policy.
Open **Desktop Agent › Settings** to configure how the [Desktop Agent](/en/v1.2/desktop/how-it-works) behaves across your company.
## Access credentials
* **Company Access Key** — employees enter this to [register](/en/v1.2/desktop/register) their Agent. **Rotate** it to issue a new key and **invalidate every existing registration at once**: all devices must re-register with the new key before they work again. Rotation is recorded in the [Audit Log](/en/v1.2/admin/audit-log).
* **Exit Password** — a single company-wide code a user must enter to quit the Agent. Entering it correctly stops the Agent for the **current session only** — it **restarts automatically on the next reboot**. This is a temporary pause, not removal; permanent removal goes through the Uninstaller or a [Hard Delete](/en/v1.2/admin/agent-users#remove-a-user).
Treat the Access Key and Exit Password as secrets. Rotating the Access Key forces every Agent to re-authenticate.
## Quotas
* **Desktop Agent Project Count** — how many Desktop Agent projects the company can create. Adjustable within `current projects ≤ new value ≤ system allowance`.
* **Agent User Count Limit** — the maximum number of registered [Agent Users](/en/v1.2/admin/agent-users). Can be lowered only to at or above current usage, and never above the system allowance.
## Network Fail-Safe
Controls what installed Agents do when they **cannot reach Starfort**. This is a **single company-wide value** — set at the company level (not per project) precisely so that devices not yet assigned to any project are still covered when the network drops. It auto-recovers when the connection returns.
| Option | Behavior |
| ----------------------- | --------------------------------------------------------- |
| **Fail-Open** (default) | Allow all intercepted requests (prioritize availability). |
| **Fail-Closed** | Block all intercepted requests (prioritize security). |
## Before a device is assigned
An Agent that is registered but **not yet assigned** to a project blocks every controlled endpoint outright — the user can't reach a governed AI service until you [assign the device](/en/v1.2/admin/agent-users#assign-users) to a project. Once assigned, the project's [Control Profiles](/en/v1.2/admin/control-profiles) take over.
This Settings screen also has an **Unassigned Default Policy** (Open / Close) toggle that controls how Agents behave before they're assigned to a project. Set it to **Open** to let unassigned Agents allow all traffic until they're assigned, or **Close** to block all traffic until they're assigned.
These settings appear only when **both** the system-wide and the company Desktop Agent features are enabled.