What each strategy alters

A workspace enrols a machine with one or more of the agent's strategies. The table below lists exactly what each strategy changes on the machine — a certificate store, a proxy setting, a registry key, a settings file — and where to find it.

TLS interception

Surface	What	Where
root	A certificate authority, name-constrained to the site catalog	The Windows trust store, and NODE_EXTRA_CA_CERTS for Node runtimes

Network steering

Surface	What	Where
pac	A proxy auto-config URL, composed with whatever was already there	The interactive user's WinINET settings, never the service account's
routes	Host routes for the catalogued services, and a TUN adapter	The machine's route table

Tool hooks

Surface	What	Where
hooks	One hook entry per registered event in each AI tool's own managed configuration, recorded in the footprint so removal is exact	Each tool's documented system hook file — for Claude Code, a managed-settings.d drop-in; for Cursor and Windsurf, the enterprise hooks.json; for Codex, requirements.toml

Browser extension

Alters nothing on the machine.

File inspection

Alters nothing on the machine.