Syncing to the Harness
One of Fleet's core jobs is pushing shared configuration from the organization to every member's Kenaz Harness. This page explains what gets pushed, who can push it, and what it looks like from a member's perspective.
:::tip Prerequisites Config sync requires your members to have signed in to Fleet from their Harness at least once. Make sure you've invited them first — see Organizations & Teams. :::
What an admin can push
When an org admin or owner publishes configuration, Fleet packages it as a signed config bundle that the Harness retrieves automatically on its next sync. Bundles are cryptographically signed, so the Harness can verify the configuration it receives came from your Fleet org and hasn't been tampered with.
The config bundle can include any combination of the following, depending on your plan:
Routing policy (Team and Enterprise)
Admins set a routing policy that tells every member's Harness which AI providers and models are allowed. The policy specifies:
- Routing mode —
localfirst(use the member's own provider configuration unless overridden) or provider-constrained modes that restrict which API calls the Harness makes. - Allowed providers — the list of AI providers members are permitted to use.
- Allowed model IDs — optionally, a specific set of models within those providers.
On Enterprise, you can write custom routing policy as Rego (Open Policy Agent) for fine-grained rules beyond the preset options.
Shared context graph (Team and Enterprise)
The context graph lets teams build up a shared knowledge base — facts, decisions, reference material, and other context nodes — that land in every member's Harness automatically. Members can also contribute their own context back up to the team graph.
There are two scopes of shared context:
| Scope | Who sees it | Who can publish it |
|---|---|---|
| Team-shared | Members of the specific team | Any member can contribute; admins can remove |
| Org-shared | Every member in the org | Admins only (promoting from team-shared to org-shared) |
On Enterprise, teams are isolated from each other's graphs by default — a member on Team A doesn't see Team B's shared context even though they're in the same org.
Policy bundle distribution (Team and Enterprise)
Beyond routing policy, admins can distribute broader configuration bundles to members' Harnesses. This capability gates on the Team plan or above. The bundle is always signed; the Harness rejects unsigned or unverifiable bundles.
How sync works
When a member's Harness signs in to Fleet:
- The Harness authenticates using the member's Fleet token.
- Fleet returns the member's org context (role, tier, team memberships).
- The Harness fetches the current config bundle for the org.
- The bundle is verified against the org's signing key before it's applied.
- The Harness applies the configuration. Members can see which policies are in effect — they're never silently hidden.
Sync happens automatically when the Harness is connected. If the Harness is offline, it keeps the last verified bundle until it reconnects.
What's bounded by role and plan
The Harness enforces what Fleet can and can't push:
- Role — members cannot receive configurations meant for admins. An org_member's Harness only receives the member-facing parts of the bundle.
- Plan — a config bundle element that requires a capability your org's tier doesn't include simply isn't included. Fleet doesn't push what the tier doesn't cover.
- Opt-in — telemetry and certain classes of data collection require explicit opt-in by the member (see Audit & Telemetry).
Member transparency
Members can always see what configuration their Harness has received from Fleet. In the Harness, the Fleet panel shows:
- Which org and team the Harness is connected to.
- Whether a routing policy is active, and what it restricts.
- What shared context is currently synced.
There's no hidden mode. If an admin publishes a routing policy that limits which models you can use, your Harness tells you that a policy is in effect.
Exporting your context
Members and admins can export the team or org-wide context graph from the Fleet dashboard at any time. Exports include all nodes and edges visible to the requester, delivered as a downloadable archive. Org-wide exports are available on Enterprise; team-scoped exports are available on Team and above.
Next: Audit & Telemetry — monitor what's happening in your org and understand how telemetry consent works.