> ## Documentation Index
> Fetch the complete documentation index at: https://docs.starfort.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Desktop Agent settings

> Configure company-level Desktop Agent settings: the Company Access Key, fail-safe behavior, and the unassigned-user default policy (Starfort v1.4 docs)

Open **Desktop Agent › Settings** to configure how the [Desktop Agent](/en/v1.4/desktop/how-it-works) behaves across your company.

<Frame caption="Desktop Agent settings (credentials masked) — Network Fail-Safe highlighted">
  <img src="https://mintcdn.com/aimintelligence/-3ie4No4rGti8Jbz/images/v1.3/admin/desktop-agent-settings.png?fit=max&auto=format&n=-3ie4No4rGti8Jbz&q=85&s=8a478c6648f9577ccf127adc94c4ecba" alt="Desktop Agent settings with the Network Fail-Safe section highlighted and credentials redacted" width="1200" height="1980" data-path="images/v1.3/admin/desktop-agent-settings.png" />
</Frame>

## Access credentials

* **Company Access Key** — employees enter this to [register](/en/v1.4/desktop/register) their Agent. **Rotate** it to issue a new key and **invalidate every existing registration at once**: all devices must re-register with the new key before they work again. Rotation is recorded in the [Audit Log](/en/v1.4/admin/audit-log).
* **Exit Password** — a single company-wide code a user must enter to quit the Agent. Entering it correctly stops the Agent for the **current session only** — it **restarts automatically on the next reboot**. This is a temporary pause, not removal; permanent removal goes through the Uninstaller or a [Hard Delete](/en/v1.4/admin/agent-users#remove-a-user).

<Warning>
  Treat the Access Key and Exit Password as secrets. Rotating the Access Key forces every Agent to re-authenticate.
</Warning>

## Quotas

* **Desktop Agent Project Count** — how many Desktop Agent projects the company can create. Adjustable within `current projects ≤ new value ≤ system allowance`.
* **Agent User Count Limit** — the maximum number of registered [Agent Users](/en/v1.4/admin/agent-users). Can be lowered only to at or above current usage, and never above the system allowance.

## Network Fail-Safe

Controls what installed Agents do when they **cannot reach Starfort**. This is a **single company-wide value** — set at the company level (not per project) precisely so that devices not yet assigned to any project are still covered when the network drops. It auto-recovers when the connection returns.

| Option                  | Behavior                                                  |
| ----------------------- | --------------------------------------------------------- |
| **Fail-Open** (default) | Allow all intercepted requests (prioritize availability). |
| **Fail-Closed**         | Block all intercepted requests (prioritize security).     |

## Before a device is assigned

How an Agent that is registered but **not yet assigned** to a project behaves is set by the **Unassigned Default Policy** (Open / Close) on this screen:

| Option             | Behavior                                                                       |
| ------------------ | ------------------------------------------------------------------------------ |
| **Open** (default) | Unassigned Agents pass all AI service requests through until they're assigned. |
| **Close**          | Unassigned Agents block all AI service requests until they're assigned.        |

Either way, no Guard Policy is enforced until you [assign the device](/en/v1.4/admin/agent-users#assign-users) to a project — once assigned, the project's [Control Profiles](/en/v1.4/admin/control-profiles) take over.

These settings appear only when **both** the system-wide and the company Desktop Agent features are enabled.