Team enrollment

Optional CLI login for org policy sync and audit push. Free CLI stays free; enrollment does not change behavior until you enroll.

Team enrollment is opt-in. Until you run kprompt login, the CLI behaves as Free: local safety only, no control-plane calls. There is no public buy/signup CTA on this site — enrollment is for orgs that already have Team access.

Login

kprompt login            # device code → approve at app.kprompt.ai/connect
kprompt login --open     # also open the browser
kprompt whoami           # org + member
kprompt logout           # revoke token + clear credentials/policy

The kp_… token is stored only in ~/.kprompt/credentials.yaml (mode 0600), never in config.yaml. Override the API with KPROMPT_API_URL / KPROMPT_API_TOKEN when needed.

Org policy

Pull caches org policy locally. Cached policy only tightens local hard-denies (namespace allow/deny, max risk, deny intents, require approve) — it never relaxes them.

kprompt policy pull      # fetch org policy → ~/.kprompt/policy.yaml
kprompt policy           # show cached policy

Audit push

When enrolled, each plan best-effort pushes an audit event (planned / denied / applied) to the control plane. Failures print a warning and never fail the local command. Disable with KPROMPT_DISABLE_AUDIT=1.

What stays local

  • Kubeconfig, cluster traffic, and LLM keys stay on your machine
  • Audit payloads omit manifests and secrets
  • History remains local (~/.kprompt/history.jsonl)
  • You can logout anytime and return to Free CLI behavior