Configuration Settings
Keeper EPM Configuration Settings Reference
This document is the complete configuration-settings reference for the Keeper Endpoint Privilege Manager (EPM) agent. It lists every setting the agent reads, organized by functional area.
Each entry shows the setting's key, default value, a description of what it controls, and any notes an administrator should know before touching it.
Total configuration settings
358
Contents
Service, Network & Messaging (37)
Security & Trust (19)
MFA & Execution Grants (6)
Session & Watchdog (12)
Logging & Monitoring (11)
Logger (11)
Boot & Performance (6)
Policy Engine (23)
Cloud & API (10)
Client UI (18)
Redirect (5)
Windows Injector (3)
Agentic / Intel (15)
Path Protection (6)
Linux Agent (14)
macOS System Extension (15)
Inventory (17)
Path Variables (1)
Deploy / MDM (3)
Job Orchestration, Automation & PAM (16)
Plugin Bootstrap & Shared Wiring (13)
Environment Variables & Platform Detection (6)
Duplicate Configuration Copies (7)
Localization (2)
Runtime & Encrypted State (6)
Research / Non-Production Tooling (3)
Service, Network & Messaging
MqttBrokerSettings:IpAddress
127.0.0.1
Embedded MQTT broker bind address (must stay localhost)
Must remain loopback for isolation; surfacing it lets admins audit/bind policy and reject non-localhost drift.
MqttBrokerSettings:Port
8675
Embedded MQTT broker port
Broker port collisions break all plugins; admins can reassign 8675 without reinstalling the agent.
Settings:KestrelHttpPort
6988
Local HTTP management API port
Port conflicts and local tooling require fleet-wide control of this endpoint.
Settings:KestrelHttpsPort
6989
Local HTTPS management API port
Plugins and jobs call the HTTPS API; relocate it if 6989 is taken or firewalled.
Settings:ServiceName
KeeperPrivilegeManager
Windows service / process display name
Some enterprises require a branded or environment-specific service name.
JobStore:StorePath
"" (data dir)
Override path for persisted job store
Admins can relocate persisted job state for large fleets/storage policies.
Settings:PluginPath
Plugins
Plugin manifest directory
Supports non-default plugin layouts (side-by-side builds, golden images).
Settings:RepositoryPath
KeeperStorage
Encrypted local repository root
Relocate encrypted state to custom data volumes or separate from Program Files.
Settings:ScriptsPath
Jobs/Scripts
Job script assets directory
Job scripts are referenced as {ScriptsPath}; relocate for least-privilege ACLs.
Settings:SharedRepositoryPath
SharedRepository
Shared cross-plugin storage root
Cross-plugin shared state may need a tenant-chosen volume for backup/capacity planning.
MqttJobPublishSettings:PublishMqtt:MaxPayloadSizeBytes
10240
Soft cap on publish-mqtt job-command payload size
Raise if legitimate payloads exceed the 10KB default.
MqttJobPublishSettings:PublishMqtt:MaxJsonDepth
10
Max JSON nesting depth accepted in publish-mqtt payloads
Bounds JSON-parsing cost/attack surface for job-published messages.
MqttJobPublishSettings:PublishMqtt:MaxJsonArraySize
1000
Max array/object element count accepted in publish-mqtt payloads
Same rationale as JSON depth; large-fleet event batching may need to exceed it.
AllowedHosts
*
ASP.NET Core host-header allowlist
⚠️ Warning: Do not edit. This governs which HTTP Host headers the local management API accepts. Changing it without understanding reverse-proxy/header behavior can break the local API entirely.
Messaging:MalformedJsonRepair:EscapeMap
Unicode control escapes
Maps control characters to JSON escapes when repairing malformed MQTT payloads
⚠️ Warning: Do not edit. Internal defensive parser plumbing; incorrect values corrupt event JSON silently.
Messaging:MalformedJsonRepair:UnmappedControlCharacterFormat
\u{X4}
Fallback escape format for unmapped control characters
⚠️ Warning: Do not edit. Developer-facing repair format, not an operational policy.
MqttTopics:publish
product topic list
Host MQTT client publish allowlist
⚠️ Warning: Do not edit. This is the product's pub/sub contract; edits desync plugins from the broker and drop audit/policy traffic.
MqttTopics:subscribe
product topic list
Host MQTT client subscribe allowlist
⚠️ Warning: Do not edit. Ship-with-build wiring, not an estate policy setting.
MqttTopics:AuditTopic
AuditMessage
Logical audit topic name
⚠️ Warning: Do not edit. Renaming breaks every publisher/subscriber that expects AuditMessage.
MqttJobPublishSettings:PublishMqtt:AllowedTopics
product wildcards
Global allowlist of topics jobs may publish to
⚠️ Warning: Do not edit. Security-critical fence for job processes; free-form edits can open broad publish access or break job status reporting.
*.metadata.mqttTopics (per plugin)
plugin-specific
Per-plugin publish/subscribe topic arrays
⚠️ Warning: Do not edit. Editing a plugin's MQTT role graph can silently break elevation, policy, or logging chains.
*.metadata.mqttRole (per plugin)
subscriber/publisher
Declares each plugin's MQTT role
⚠️ Warning: Do not edit. Loader/authorization topology metadata, not a tunable setting.
Subscription.Topic / Qos / CleanSession (per plugin)
per plugin
Primary MQTT subscription block on each plugin's manifest
⚠️ Warning: Do not edit. Changing QoS/CleanSession without coordinated code changes is unsupported and can disconnect the plugin from the broker.
MqttJobPublishSettings:PublishMqtt:MaxPayloadSizeBytesHardLimit
102400
Compile-time hard ceiling on publish-mqtt payload size
⚠️ Note: This is a code-enforced safety ceiling above the tenant-tunable soft cap and cannot be changed via configuration.
MqttJobPublishSettings:ShowToast:MaxPayloadSizeBytes / ShowToast:DefaultSeverity
10240 / Info
Payload cap and default severity for the show-toast job command
⚠️ Warning: Do not edit. Raising the payload cap without coordinated client changes can cause silent message drops.
publishing.topic / .qos / .retain / .frequency, message.payloadformat / .maxsize
various
Default MQTT wiring handed to any plugin lacking its own configuration
⚠️ Warning: Do not edit. Internal protocol defaults, not an independent tenant setting.
Logging:LogLevel:Microsoft
Information
ASP.NET Microsoft.* category log level
⚠️ Note: Framework noise knob; the equivalent Keeper-level logging controls are listed under Logging & Monitoring.
Logging:LogLevel:Microsoft.AspNetCore.Server.Kestrel
Information
Kestrel web-server category log level
⚠️ Note: Rarely useful outside engineering diagnostics of the local HTTPS endpoint.
Logging:LogLevel:Microsoft.Hosting.Lifetime
Information
Hosting lifetime category log level
⚠️ Note: Startup/shutdown framework logging, not an operational setting.
Logging:LogLevel:System
Information
System.* framework category log level
⚠️ Note: Overlaps with the Keeper-specific logging controls listed under Logging & Monitoring.
broker.host / broker.port (injected)
mirrors of broker settings
MQTT host/port injected into every plugin's settings
⚠️ Note: Duplicate mirror of the broker settings above; change the source once, not per plugin.
system.service.https_port / .http_port / .name (injected)
mirrors of service settings
Service identity/port re-projected to every plugin
⚠️ Note: Duplicate mirror of the service settings above.
broker.connectiontimeout / broker.keepalive / system.mqtt.enabled (injected)
10000 / 60 / true
Hardcoded MQTT connection tuning advertised to every plugin
⚠️ Note: Not configurable at all — literal constants in code.
system.transaction.default_timeout_minutes / .max_per_plugin / .cleanup_interval_minutes (injected)
30 / 50 / 60
Transaction tuning values advertised to plugins
⚠️ Note: Confirmed dead/inconsistent in current code; not a functioning tenant knob.
transaction.enabletracking (system-level)
false
Legacy system-wide transaction-tracking flag
⚠️ Note: Hardcoded legacy flag; the feature it referred to was removed.
metadata (per plugin, via Admin API)
plugin's manifest JSON
Read-through mirror of a plugin's canonical manifest
⚠️ Warning: Read-only. Source code explicitly documents this as not customer-tunable — the live manifest file always wins over any stored copy.
security.usetls (injected)
false
Default TLS-usage flag for plugin MQTT/HTTP connections
⚠️ Warning: Do not edit. Flipping this fleet-wide without coordinated certificate/broker configuration will break connections.
Security & Trust
Settings:AllowedNonAdminExecutables
product UI list
Binaries allowed without admin rights in the user context
Controls which Keeper UI helpers may run unelevated.
Settings:AlternativeSignatures
[]
Extra trusted code-signing thumbprints for plugins
Required if partners/internal builds sign plugins with non-Keeper certificates.
Settings:CriticalSystemDirectories
OS critical dirs
Directories protected from elevation/redirect tampering
Blocks grants that target OS-critical trees.
Settings:CriticalSystemFiles
OS critical exes
Files protected from elevation/redirect tampering
Defines OS binaries that elevation/redirect must never rewrite.
Settings:MaintainKeeperAccount
false
Persist the KeeperUserSession account across restarts (Windows hybrid AAD + Intune)
Required for hybrid AAD+Intune endpoints to retain elevation after reboot.
ConfigurationLkg:Enabled
true
Last-known-good reconciliation for policy-written configuration
Enables self-healing after a bad configuration push.
Settings:CertName
""
Certificate subject/name in store
Required whenever CertStore is used in corporate PKI deployments.
Settings:CertPassword
""
TLS certificate password
Secret value — vault/mask in the console; never store as plaintext.
Settings:CertPath
""
TLS certificate file path
Custom TLS for the local API using enterprise PKI paths.
Settings:CertStore
""
Windows certificate store name
For enterprises using Windows certificate stores instead of files.
Plugins:JobService:AgentInactiveJobAllowlist
registration, StartKeeperClient, ...
Jobs allowed to run when the agent UI is inactive
Security-sensitive allowlist; misuse can launch UI jobs headlessly.
KeeperRunAs.metadata.elevationStage
first
Marks the first stage of two-stage elevation
⚠️ Warning: Do not edit. Hard-wired stage identity; changing it does not re-architect elevation, it only breaks diagnostics.
KeeperRunAs.metadata.launches
KeeperRunElevated
Downstream elevated executable name
⚠️ Warning: Do not edit. Wrong target breaks all Windows elevations.
KeeperRunAs.metadata.credentialHandling
ephemeral-accounts
Credential strategy label
⚠️ Note: Descriptive product contract, not a selectable account model.
KeeperRunAs.metadata.features / securityLevel / launchesElevated
product tags
Feature tags for the RunAs stage
⚠️ Note: Documentation metadata for tooling; no runtime effect.
KeeperRunElevated.metadata.elevationProxy
true
Marks the elevation-proxy role
⚠️ Warning: Do not edit. Stage identity for the elevation proxy.
KeeperRunElevated.metadata.requiresEphemeralCredentials
true
Requires ephemeral admin credentials
⚠️ Warning: Do not edit. Product security invariant; disabling is unsupported and weakens the elevation model.
KeeperRunElevated.metadata.apiEndpoints
elevation API paths
Documents the local elevation API routes
⚠️ Note: Reference metadata; routes are compiled into the product.
KeeperRunElevated.metadata.features / securityLevel
product tags
Feature tags for the elevation proxy
⚠️ Note: Non-behavioral metadata.
MFA & Execution Grants
ExecutionGrant:DefaultDurationMinutes
240
Default execution grant lifetime (minutes)
Default JIT grant lifetime for approved elevations.
ExecutionGrant:MaxDurationMinutes
10080
Maximum execution grant lifetime (7 days)
Hard ceiling so policies cannot issue week-plus grants.
MfaGracePeriod:GracePeriodMinutes
5
Skip MFA re-prompt window after a successful challenge
Balances productivity vs. session-hijack risk.
MfaLockout:LockoutDurationMinutes
15
MFA lockout duration after maximum failures
Balances lockout pain vs. attacker retry windows.
MfaLockout:MaxFailedAttempts
5
Failed MFA attempts before lockout
Sets brute-force resistance for MFA controls.
Controls:maxJustificationTextLength
512
Max characters in justification control text
Caps justification payload size; aligns with ticket-field limits.
Session & Watchdog
SessionMonitoring:Enabled
true
Enable user-session polling
Master switch for detecting logons/sessions that start KeeperClient.
SessionMonitoring:ExcludedUsers
SYSTEM, LOCAL SERVICE, ...
Accounts excluded from session handling
Prevents session handling for service accounts.
SessionMonitoring:StartKeeperClientOnLogin
true
Launch KeeperClient when a user logs in
Required for request/approval workflows to be reachable.
SessionMonitoring:StartKeeperClientOnReconnect
true
Relaunch KeeperClient on session reconnect
Needed for RDP/reconnect scenarios.
Watchdog:AutoRemediate
true
Automatically restart unhealthy KEPM components
Chooses self-healing vs. alert-only when unhealthy.
SessionEventDispatcher:StartKeeperClientCoalesceSeconds
12
Debounce rapid session events before starting the client
Prevents duplicate KeeperClient launches from bursty logon events.
SessionMonitoring:PollingIntervalSeconds
5
How often active sessions are scanned
CPU vs. detection-latency knob for dense/VDI hosts.
Watchdog:CheckIntervalSec
10
Watchdog health-check interval
Faster intervals detect outages sooner but add host noise.
Watchdog:StartupDelaySec
90
Grace period after boot before remediation
Avoids false unhealthy restarts during slow boots/AV scans.
Watchdog:UnhealthyRestartThreshold
3
Consecutive failures before restart
Prevents flapping on transient blips.
SessionMonitoring:LinuxDesktopProcesses
gnome-shell, kwin, ...
Linux processes that indicate an interactive desktop
Desktop-session heuristics differ by distro/DE.
SessionMonitoring:MacOSDesktopProcesses
Dock, Finder, WindowServer
macOS processes that indicate an interactive desktop
Customize for atypical macOS environments.
Logging & Monitoring
KeeperSystemLogging:MinimumSystemLogLevel
Information
Floor for OS system-log entries
Filters OS-log volume vs. security-event fidelity.
KeeperSystemLogging:SystemLoggingEnabled
true
Master switch for OS event-log / syslog output
Required by many SIEM/compliance pipelines.
Settings:system.logging.level
Warning
Main service log level shorthand
Primary troubleshooting lever; escalate to Debug fleet-wide without remote access.
PluginMonitoring:Enabled
true
Master switch for plugin process health monitoring
Disables fleet-wide health monitoring when off.
KeeperSystemLogging:EnableInfoFallback
true
Fallback Info-level logging when KeeperLogger is down
Preserves audit breadcrumbs during outages.
KeeperSystemLogging:PluginCheckIntervalMinutes
5
How often Logger plugin health is verified
Lower to detect silent log loss faster.
PluginMonitoring:CheckIntervalMinutes
0.5
Plugin process health-check cadence
Availability vs. CPU tradeoff for crash detection.
KeeperSystemLogging:DebugFilteredMessages
false
Verbose diagnostics for filtered system-log messages
Shows what the system logger dropped; used for SIEM filter tuning.
Logging:LogLevel:Default
Information
ASP.NET framework default log level
Useful when Kestrel/auth middleware issues must be captured.
PluginMonitoring:LogHealthChecks
false
Log every plugin health-check result
Verbose health spam for short-lived diagnosis of restart loops.
KeeperPolicy.metadata.processTreeDebug.logToEventLog
false
Enables very-high-volume process-ancestry debug logging
⚠️ Warning: Debug-only. Floods the Event Log; enable only for a live troubleshooting session under Keeper support guidance, then disable it again.
Logger
KeeperLogger.metadata.logFileName
Log/KeeperLogger.log
Log file path
Redirect logs to approved paths for ACL and collection agents.
KeeperLogger.metadata.logRetentionDays
15
Days to keep rotated logs
Must match legal hold / SIEM ingest SLAs.
KeeperLogger.metadata.logToFile
true
Write aggregated logs to disk
Required for offline forensics on locked-down images.
KeeperLogger.metadata.maxFileSizeMB
100
Log rotation size (MB)
Affects disk usage and log history depth.
KeeperLogger.metadata.loggingHttpEndpoint
""
Remote HTTP log sink URL
Target for remote log forwarding when enabled.
KeeperLogger.metadata.logToHttpEndpoint
false
Forward logs to an HTTP sink
Ship logs to a tenant HTTP collector without a separate forwarder.
KeeperLogger.metadata.mqttRole / mqttTopics
subscriber
Logger MQTT wiring
⚠️ Warning: Do not edit. Topology only — the actual sink settings are listed above.
KeeperLogger.metadata.taskDelay
250
MQTT loop delay (ms)
⚠️ Note: Internal pacing/micro-tuning; changing it fleet-wide risks message backlog with no clear benefit.
KeeperUSession.metadata.mqttTopics / mqttRole
product topics
USession / injector host MQTT map
⚠️ Warning: Do not edit. Windows injector host wiring; the admin-facing controls are allow.dat/exclude.dat under Windows Injector.
KeeperUSession.metadata.logToFile / logFileName / maxFileSizeMB / logRetentionDays / logToHttpEndpoint / loggingHttpEndpoint
logger-like defaults
Legacy logging block on the USession component
⚠️ Warning: Do not edit. Duplicates the Logger settings above; editing both creates split-brain logging. Use the Logger settings instead.
KeeperUSession.metadata.taskDelay
250
USession MQTT loop delay
⚠️ Note: Same micro-tuning concern as the Logger's taskDelay.
Boot & Performance
Settings:BootPhase:Enabled
true
Defer non-critical jobs after boot/logon
Protects login-time UX by deferring heavy jobs during boot storms.
Settings:BootPhase:DeferNonCriticalJobsAfterBootMinutes
3
Post-boot grace window (minutes)
Prevents inventory/updater contention with logon scripts.
Settings:BootPhase:DeferNonCriticalJobsAfterLogonMinutes
2
Post-logon grace window (minutes)
Per-user logon grace for multi-session hosts.
Settings:BootPhase:DeferPolicyPathObservedDuringGrace
true
Buffer inventory/path triggers during grace
Prevents queuing dozens of scans during logon storms.
Settings:BootPhase:KeeperUpdaterLogonDeferralSeconds
90
Updater deferral after logon (seconds)
Stops updater I/O from colliding with first-login installs.
Settings:BootPhase:MaxConcurrentExternalProcessesDuringGrace
3
Max external job processes during grace
Caps job fan-out to protect CPU/disk on thin clients.
Policy Engine
KeeperPolicy.metadata.admin.enforce_policies_for_administrators
true
When true, wildcard-user policies also apply to administrators
Core security posture — whether local admins bypass wildcard policies.
KeeperPolicy.metadata.execution_grant.default_duration_minutes
240
Policy-level override for grant TTL
Independent of the host ExecutionGrant default for tighter JIT control.
KeeperPolicy.metadata.riskscore.default_score
5.0
Default risk score when assessment is unavailable
Sets allow/deny bias for incomplete risk data.
KeeperPolicy.metadata.riskscore.use_default_on_failure
false
Use the default score vs. fail when a risk job errors
Security-critical fail-open vs. fail-closed switch.
KeeperPolicy.metadata.agentApplicationInventory.maxAgeSeconds
86400
Stale-inventory threshold for agentic/vulnerability gates
Tune for offline or slow-sync endpoints.
KeeperPolicy.metadata.agentApplicationInventory.path
"" (env/platform default)
Override path for the agent-application-inventory mirror file
Same storage-relocation rationale as RepositoryPath/SharedRepositoryPath.
KeeperPolicy.metadata.agenticSnapshot.vulnerabilityRiskMaxContribution
3.0
Max vulnerability risk contribution from the inventory mirror
Prevents vulnerability noise from dominating policy scores.
KeeperPolicy.metadata.eventTypeJobMapping
product map
EventType → control-job ID mapping
Routes event types to control workflows.
KeeperPolicy.metadata.eventTypeRiskJobMapping
product map
EventType → risk-assessment job mapping
Chooses which risk job runs per event type.
KeeperPolicy.metadata.processCatalog.retentionHours
24
Cross-session process-catalog retention
Longer retention helps RDP/JIT attribution but grows disk use.
KeeperPolicy.metadata.lookup.slowCallTimeoutSeconds
5
macOS/Linux slow policy-lookup timeout
Raise when directory servers are slow.
KeeperPolicy.metadata.maxRetryAttempts
3
Retries for failed policy operations
Resilience against transient MQTT/API failures.
KeeperPolicy.metadata.taskDelay
250
MQTT message loop delay (ms)
Advanced tuning when policy latency or CPU spikes appear.
KeeperPolicy.metadata.eventTypeJobMapping._defaultJobId
default-policy-controls
Fallback control-workflow job when no EventType mapping matches
⚠️ Note: Sub-field of the eventTypeJobMapping setting listed above; the default fallback specifically is not separately editable.
KeeperPolicy.metadata.eventTypeJobMapping.mappings
EventType→job-id map
Maps policy EventType → job ID for controls workflows
⚠️ Note: Sub-field of the eventTypeJobMapping setting listed above.
KeeperPolicy.metadata.eventTypeRiskJobMapping._defaultJobId
composite-risk-evaluation
Fallback risk-assessment job
⚠️ Note: Sub-field of the eventTypeRiskJobMapping setting listed above.
KeeperPolicy.metadata.eventTypeRiskJobMapping.mappings
EventType→risk-job map
Maps policy EventType → risk-assessment job ID
⚠️ Note: Sub-field of the eventTypeRiskJobMapping setting listed above.
KeeperPolicy.metadata.storage.sharedContainers
PolicyRegistry, AgentApplicationInventory
Named shared storage container definitions
⚠️ Warning: Do not edit. Renaming containers orphans encrypted data.
KeeperPolicy.metadata.agenticSnapshot.path
""
Deprecated telemetry snapshot path
⚠️ Warning: Deprecated. Realtime writer now uses the inventory mirror; do not point this at a live path.
KeeperPolicy.metadata.agenticSnapshot.maxAgeSeconds
120
Deprecated snapshot max age
⚠️ Note: Dead alongside the deprecated snapshot path above.
KeeperPolicy.metadata.processCatalog.path
""
Durable process-catalog path
⚠️ Note: Empty means in-memory only; this is deployment plumbing, not a tenant policy decision.
KeeperPolicy.startupPriority / .autoStart / .requiresMonitoring / .autoRestart
15 / true / true / true
Core policy-engine service lifecycle
⚠️ Warning: Do not edit. Boot ordering is carefully chosen; reordering can cause race conditions at startup.
KeeperPolicy.metadata.mqttTopics.subscribe / .publish
["RequestApproval"] / 15-entry list
MQTT wiring for the policy engine
⚠️ Warning: Do not edit. Editing the policy engine's MQTT role graph can break elevation/policy chains fleet-wide.
Cloud & API
KeeperApi.metadata.cveCatalog.refreshHours
6
CVE catalog refresh interval (hours)
Air-gapped/bandwidth-limited sites may need longer intervals.
KeeperApi.metadata.maxJustificationTextLength
512
Max justification text synced with the cloud
Must match ticket systems and the Controls limit.
KeeperApi.metadata.approval.useNewTypes
true
Use the new approval-type mapping for agentic policies
Feature flag during rollout of new policy schemas.
KeeperApi.metadata.transactionTracking
true
Track cloud transaction state for API calls
Enables cloud transaction correlation for support/audit.
ROUTER_URL (environment variable)
(unset)
Environment override for the Keeper cloud router URL
For air-gapped or private Keeper router deployments.
KeeperApi.metadata.mqttTopics / mqttRole
cloud bridge topics
KeeperApi MQTT topology
⚠️ Warning: Do not edit. Cloud-bridge wiring; edits can disconnect the agent from the Keeper backend.
KeeperApi.metadata.category
Keeper API
UI category label
⚠️ Note: Cosmetic label only.
KeeperApi.metadata.cveCatalog.subfolder
AgenticIntel
Subfolder name under the data directory for CVE intel
⚠️ Note: Folder naming is product layout; the refresh interval above is the tunable setting.
KeeperApi.requiredPermissions / startupPriority / .autoStart / .requiresMonitoring / .autoRestart / Subscription.Topic / .Qos / .CleanSession
various
Core backend-communication plugin bootstrap and lifecycle
⚠️ Warning: Do not edit. This plugin is started early and monitored by design; reordering or disabling monitoring can break cloud connectivity.
KeeperApi.metadata.mqttTopics.publish / .subscribe
topic lists
Publish/subscribe topics for the cloud-bridge plugin
⚠️ Warning: Do not edit. Same MQTT-role-graph risk as above.
Client UI
elevation-allowed-extensions.json
windows: .exe/.bat/.cmd/.msi/.ps1
Allowed Request Elevation file types per OS
Wrong list blocks .msi/.ps1 requests or opens risky file types.
keeperAgent.metadata.approvalExpirationHours
72
Hours until a pending approval expires
Prevents approval queues from growing stale.
keeperAgent.metadata.approvedRequestExpirationHours
24
Hours until an approved grant can no longer launch
Shorter TTL reduces lingering privilege.
KeeperClient.metadata.LanguageOverride
DEFAULT
UI language override
Forces UI locale independent of OS language.
KeeperClient.metadata.showInTray
true
Show the KeeperClient system tray icon
Some kiosks hide tray icons; interactive desktops usually require them.
keeperAgent.metadata.historyRetentionDays
30
Local request-history retention
Balances self-service value against privacy/disk limits.
keeperAgent.metadata.maxPayloadSizeBytes
1048576
Max MQTT payload size the agent UI accepts
Raise if request/approval payloads legitimately need to be larger.
keeperAgent.metadata.showInTray
false
Show the keeperAgent tray icon
Separate tray presence from KeeperClient.
KeeperClient.metadata.menu.autoRefresh
true
Auto-refresh the tray menu on a timer
Disable to stop timer churn on locked-down thin clients.
KeeperClient.metadata.menu.items
product menu
Tray menu jobs, dialogs, and visibility filters
Customizes which request/approval jobs appear in the tray.
KeeperClient.metadata.menu.refreshIntervalMinutes
5
Tray menu refresh interval
Tune for VDI density vs. API load.
keeperAgent.metadata.maxHistoryItems
20
Max history items shown in the UI
Bounds rendering cost on busy approvers' machines.
keeperAgent.metadata.maxRequestItems
20
Max pending requests shown in the UI
Prevents huge pending queues from freezing the dialog.
KeeperClient.metadata.mqttTopics / mqttRole / uiComponent / requiresDisplay
UI host flags + topics
Client MQTT wiring and UI host flags
⚠️ Warning: Do not edit. Tray/language/menu settings above are the supported controls; the underlying MQTT/UI-host flags are bootstrap plumbing.
keeperAgent.metadata.mqttTopics / mqttRole / uiComponent / requiresDisplay
UI host flags + topics
Agent UI MQTT wiring and host flags
⚠️ Warning: Do not edit. Same bootstrap-plumbing concern as KeeperClient.
keeperAgent.metadata.maxExceptionMessageLength
500
UI exception-message truncation length
⚠️ Note: Cosmetic UI limit, not a security or policy setting.
KeeperClient.metadata.toastIcon.windows
Assets/kepm-toast.png
Toast-notification icon path for Windows
⚠️ Note: Cosmetic branding asset path; editing it does not change behavior.
keeperAgent.executionContext / KeeperClient and keeperAgent bootstrap fields
User / various
UI-host process lifecycle and security context
⚠️ Warning: Do not edit. These define the security boundary each UI process runs under.
Redirect
RedirectEvaluator.metadata.redirect.enabled
true
Enable launch redirects during privilege elevation
Master switch for this security feature.
RedirectEvaluator.metadata.redirect.rules
ncpa, Notepad, Terminal, MSI...
Redirect rules mapping elevation requests to safer substitutes
Core customization point for org-specific tools and installers.
RedirectEvaluator.metadata.redirect.rulesPath
(optional)
Optional external file for redirect rules
⚠️ Note: Documented as an optional feature; not confirmed to be functional in the current agent build. Treat as informational until confirmed.
RedirectEvaluator.arguments
--baseurl {KeeperApiBaseUrl}
Launch arguments passed to the evaluator process
⚠️ Warning: Do not edit. Product launch contract for this process.
RedirectEvaluator.metadata.mqttTopics.publish
["KeeperLogger"]
MQTT wiring (publish-only)
⚠️ Warning: Do not edit. Bootstrap MQTT plumbing.
Windows Injector
allow.dat
Keeper + Windows allowlist
Process allowlist beside KeeperUSession — listed apps bypass policy checks
Wrong entries create silent policy bypasses.
exclude.dat
OS/AV/browser exclusions
Process/path exclusion list for injector attach
Critical for AV/EDR coexistence.
noautoinject.dat
(empty on install)
Optional list of processes not auto-injected at session start
Fine-grained opt-out for fragile applications.
Agentic / Intel
AgenticChainIntermediaryBasenames.json
cmd, powershell, wt, wsl, …
Shell/terminal basenames allowed between an AI agent and a tool subprocess
Required for accurate AI-attribution chains.
AiLikelihoodCapSettings.json
maxAiLikelihoodPercent=75
Caps AI likelihood for browser/webview-like basenames; also excludes Keeper's own binaries from inventory noise
Prevents browsers from being scored as AI agents.
AiLikelihoodFloorSettings.json
minAiLikelihoodPercent=100
Curated native AI-agent executables (identity-verified)
Update as new AI products ship to keep attribution accurate.
intel/app-catalog.ndjson(.gz)
(via KeeperApi refresh)
Current vulnerability/product catalog source
Authoritative product/CVE catalog for vulnerability baselines.
intel/rules/AI_Detection.json
staticAnalysis + signatures
Heuristic rules for AI/static-scan scoring
Directly drives agentic policy outcomes.
intel/rules/Risk_Behavior.json
identity privilege tiers
Risk-behavior heuristic rules
Feeds riskBehavior scores for policy gates.
intel/rules/Vulnerability.json
CVE/KEV boost rules
Vulnerability heuristic rules
Security teams tune CVSS/KEV thresholds here.
SystemShellBasenames.json
explorer, cmd, powershell, …
OS shell/system basenames that must never be classified as AI agents
Misclassification breaks agentic attribution.
intel/normalized-vulnerability.jsonl
(feed present on install)
Legacy CVE feed
Superseded by app-catalog.ndjson(.gz); still shipped for compatibility.
ShellMediatedParentBasenames.json
svchost, RuntimeBroker, shells…
Parent basenames eligible for shell-mediated spawn-bridge attribution
Wrong list drops AI lineage across broker/AppX hops.
static-scan-product-haystack.json
scoreBuckets (embedded)
Static-scan product haystack buckets for AI scoring
Updating patterns improves detection without agent rebuilds.
KeeperAgenticSnapshotWriter manifest bootstrap
paths/priority/autoStart
How the Rust snapshot writer is launched
⚠️ Warning: Do not edit. Installer-owned; the intel/rules content above is the supported admin surface.
KeeperAgenticSnapshotWriter.metadata.taskDelay
250
Writer loop delay
⚠️ Note: Internal pacing, not a risk-policy control.
KeeperAgenticSnapshotWriter.metadata.hostProcess
KeeperPrivilegeManager
Expected host process name
⚠️ Warning: Do not edit. Security/identity expectation for the writer; must stay product-fixed.
SchemaVersion field (inside AiLikelihood/SystemShell/ShellMediatedParent/AgenticChainIntermediary content files)
1–3 depending on file
Internal format-versioning field
⚠️ Note: Bookkeeping for forward-compatible parsing; not a tenant-editable value.
Path Protection
LeastPrivilegeExclusions
(policy/storage)
Accounts excluded from least-privilege enforcement
Protects break-glass accounts that must keep admin rights.
PolicyProtectedDirectories.json
(from ProtectedPaths)
Protected directories written from ProtectedPaths policies
Materialized output of enforced ProtectedPaths policies.
ProtectedPaths (policy type)
(policy-driven)
Console policy type protecting paths from conflicting FileAccess policies
Primary admin path-protection UX.
UserProtectedDirectories.json
(optional overlay)
Admin/local overlay of wildcard FileAccess protected directories
For site-specific sensitive trees beyond platform defaults.
{Platform}ProtectedDirectories.json
OS defaults
Platform default protected directories
Baseline protected directories per platform.
LinuxProtectedDirectories.json
filesystem defaults
Linux fanotify/path exclusions for protected directories
Distro layouts differ; adjust for local integrity/noise needs.
Linux Agent
KeeperLinuxAgent.metadata.mqttOutages.connectionFailureBehavior
allow
Allow/deny when the MQTT broker is unavailable
Security-critical — defines offline enforcement posture on Linux.
KeeperLinuxAgent.metadata.policy.maxResponseTimeout
5.0
Max wait for a policy decision (seconds)
Raise for slow disks/directory lookups.
KeeperLinuxAgent.metadata.policy.onPolicyTimeout
allow
Allow/deny when policy evaluation times out
Security-critical — decides whether hangs become silent permits.
KeeperLinuxAgent.metadata.commandLine.allowPaths
systemd / apport paths
Command-line allow paths (noise reduction)
Reduces alert fatigue from expected system processes.
KeeperLinuxAgent.metadata.fileAccess.allowPaths
systemd / apport paths
File-access allow paths (noise reduction)
Keeps FileAccess policies usable amid systemd/apport noise.
KeeperLinuxAgent.metadata.fileAccess.uidThreshold
1000
UID threshold for file-access event filtering
Cuts event floods from system daemons.
KeeperLinuxAgent.metadata.policy.cache.cleanupInterval
30
Decision cache cleanup interval
Tune under memory pressure.
KeeperLinuxAgent.metadata.policy.cache.expireAfter
60
Decision cache TTL (seconds)
Balances freshness vs. performance.
KeeperLinuxAgent.metadata.policy.sessionInfrastructureProcesses
gnome-shell, plasmashell, ...
Desktop-infrastructure processes excluded from heavy policy
Prevents over-policing desktop compositors.
KeeperLinuxAgent.metadata.policy.sessionShellProcesses
bash, sh, zsh, ...
Shell processes treated as session infrastructure
Customize per org's default shells.
KeeperLinuxAgent.metadata.mqttOutages.retries.minDelay / .maxDelay
1 / 20 (seconds)
MQTT reconnect backoff bounds
Controls how long the fail-open/fail-closed window persists during an outage.
KeeperLinuxAgent.metadata.fileAccess.filterKeeperPaths / commandLine.filterKeeperPaths / commandLine.uidThreshold
["/opt/keeper"] / ["/opt/keeper"] / 1000
Keeper's-own-path self-exclusion filters and a duplicate UID threshold
⚠️ Note: Self-referential exclusions and a duplicate of the fileAccess.uidThreshold setting above; not a distinct policy decision.
KeeperLinuxAgent.startupPriority / .autoStart / .requiresMonitoring / .autoRestart
80 / true / true / true
Linux fanotify agent lifecycle
⚠️ Warning: Do not edit. Boot ordering for this kernel-level intercept is carefully chosen.
KeeperLinuxAgent.metadata.mqttTopics.publish / .subscribe
topic lists
MQTT wiring for the Linux agent
⚠️ Warning: Do not edit. Editing this can silently break Linux policy enforcement.
macOS System Extension
SystemExtension.metadata.mqttOutages.connectionFailureBehavior
allow
Allow/deny when the MQTT broker is unavailable
Security-critical — defines offline Endpoint Security posture.
SystemExtension.metadata.policy.highLoad.fallbackAllowPaths
system + /Library/Keeper
Paths allowed under high-load fallback
Must include system+Keeper paths or logon breaks.
SystemExtension.metadata.policy.highLoad.inflightThreshold
200
In-flight events before high-load fallback
Tripwire protecting against event-storm UI freezes.
SystemExtension.metadata.policy.maxResponseTimeout
5.0
Max wait for a policy decision (seconds)
FDA-denied lookups may need longer timeouts.
SystemExtension.metadata.policy.onPolicyTimeout
allow
Allow/deny when policy evaluation times out
Security-critical — wrong default creates silent permits or freezes.
SystemExtension.metadata.commandLine.allowPaths
/Library/Keeper, sudo
Command-line allow paths
Avoids alert fatigue from expected cmdline monitors.
SystemExtension.metadata.fileAccess.allowPaths
system + Keeper paths
File-access allow paths
Reduces noise from system frameworks.
SystemExtension.metadata.policy.cache.cleanupInterval
30
Decision cache cleanup interval
Tune under memory pressure; same rationale as the Linux Agent's equivalent setting.
SystemExtension.metadata.policy.cache.expireAfter
60
Decision cache TTL (seconds)
Performance vs. freshness for macOS ES decisions.
SystemExtension.metadata.privilegeElevation.allowPaths
loginwindow, Keeper, ...
Privilege-elevation allow paths
Lets loginwindow/authtrampoline elevate without false policy hits.
SystemExtension.metadata.transaction.enabletracking
false
Enable transaction tracking in the System Extension
Optional correlation for macOS ES debugging/audit.
SystemExtension.metadata.mqttOutages.retries.minDelay / .maxDelay
1 / 20 (seconds)
MQTT reconnect backoff bounds
macOS counterpart to the Linux Agent's equivalent setting.
SystemExtension.supportedPlatforms
["macOS"]
Platform filter for this extension
⚠️ Note: Build/installer platform-filtering concern; console toggles won't add missing binaries.
SystemExtension.autoStart / .requiresMonitoring / .autoRestart
false / false / false
Extension lifecycle flags
⚠️ Warning: Do not edit. This is loaded by the macOS system-extension framework, not KPM-managed lifecycle.
SystemExtension.metadata.mqttTopics.publish / .subscribe
topic lists
MQTT wiring for the System Extension
⚠️ Warning: Do not edit. Editing this can silently break macOS Endpoint Security enforcement.
Inventory
InventoryFull.EnableExecutableOnlyScanning
true
Limit scan to executable/package types
Focuses inventory value vs. whole-disk crawl cost.
InventoryFull.ExcludePaths
cross-platform list
Paths excluded from full inventory scan
Skipping large trees (WinSxS, node_modules) is required to finish scans.
InventoryFull.MinDaysBetweenRuns
3
Minimum days between full inventory scans
Full scans are expensive; cadence must match endpoint capacity.
InventoryFull.EnableHashCaching
true
Cache file hashes between runs
Speeds incremental-ish full runs.
InventoryFull.ExcludeDevelopmentDirectories
false
Exclude development tool directories
Keeps fleet scans tractable on dev workstations.
InventoryFull.ExcludeUserSpecificDirectories
false
Exclude per-user directories from the scan
Privacy/performance option for shared kiosks.
InventoryFull.ExcludeVirtualizationDirectories
true
Exclude VM/container directories
Prevents container/VM images from exploding scan time.
InventoryFull.HashCacheValidityDays
7
Hash cache validity window
Staleness window for cached hashes vs. rescan cost.
InventoryFull.MaxConcurrentFiles
3
Parallel file-processing limit
Tune for SSD vs. spinning disk or AV-contention hosts.
InventoryFull.MaxFileSizeBytes
500000000
Skip files larger than this size
Skips huge blobs that burn hash time without security value.
InventoryFull.MaxMemoryUsageBytes
268435456
Memory budget for the inventory process
Prevents OOM-killing thin VDI agents.
InventoryFull.PriorityExtensions
exe/script/package
File extensions prioritized during scan
Ensures high-value extensions are scanned first when time-budgeted.
InventoryFull.MaxDirectoryDepth
20
Maximum directory recursion depth
Stops pathological deep trees from hanging the job.
InventoryFull.ThrottleDelayMs
25
Throttle delay between file operations
Yields for AV-friendly scanning on contended endpoints.
BatchSize / CheckpointFrequency / MaxDirectoryQueueSize / MaxFilesPerDirectory / FileOperationTimeoutSeconds
50 / 500 / 10000 / 10000 / 30
Scan-engine batching, checkpointing, queue-size, and timeout internals
⚠️ Note: Implementation-detail tuning for the scan loop; misconfiguring risks stalls or resource exhaustion.
EnableIncrementalScan / EnableProgressReporting / EnableSecurityValidation / EnableDynamicSystemExclusions / EnableExecutableExtensionFilter / EnableExecutablePermissionCheck / EnableExecutableMagicNumberDetection / EnableNonExecutableDirectorySkipping / EnableExecutableDirectoryPrioritization
true (most) / false (two)
Detection-algorithm toggles for how the scanner identifies executables
⚠️ Warning: Do not edit. Disabling any of these silently degrades scan accuracy/coverage — e.g. skipping magic-number or security validation.
Inventory plugin manifests (KeeperInventoryFull / Basic / Incremental / User)
MQTT + bootstrap
Inventory plugin launch manifests
⚠️ Warning: Do not edit. Scan behavior is controlled by the settings above; these manifests only control how the scan binaries are launched.
Path Variables
Custom path variables (arbitrary name→value)
(none)
Admin-defined path placeholders via the PathVariables API
Built-in variables are read-only; custom ones let policies/jobs use org path aliases.
Deploy / MDM
Full Disk Access (SystemPolicyAllFiles)
KEPM paths
Full Disk Access grants for the KEPM launcher/daemon/notify/trash
Mandatory for reliable process/file visibility on macOS.
KEEPERREGCODE
(MDM-supplied)
macOS managed preference for the agent registration code
Device join secret; must be pushed via MDM, not left unset.
System Extension allowlist (Team ID 234QNB7GCA)
com.keeper...monitor
Allows the Endpoint Security system extension via MDM
Without allowlisting, macOS blocks the extension and monitoring never starts.
Job Orchestration, Automation & PAM
Policy-control job graphs (privilege-elevation-policy-controls, file-access-policy-controls, default-policy-controls, agentic-*-policy-controls, and headless variants)
product workflows
Ordered tasks for MFA/justification/approval
⚠️ Warning: Do not edit. Behavior is selected by policies and the Policy Engine's event→job maps above; editing raw job JSON is unsupported and high-risk.
Risk-assessment jobs (composite-risk-evaluation, file-risk-assessment, user-risk-assessment, machine-risk-assessment, location-risk-assessment, url-risk-assessment)
product workflows
Risk-scoring pipelines
⚠️ Warning: Do not edit. Driven by the Policy Engine's risk-job mapping, not free-form settings.
Lifecycle/maintenance jobs (ProcessConfigurationPolicies, registration, store-cleanup, ephemeral-*-cleanup, ExecutionGrantStartupCleanup, FileAccessStartupCleanup, mfa-lockout-*, locale-cache-cleanup)
product workflows
Agent maintenance automations
⚠️ Note: Not intended as ad-hoc key/value settings.
Launch/helper jobs (LaunchPrivilegeElevation, LaunchFileAccess, LaunchApprovedRequest, StartKeeperClient, ShowAgent, GrantFileAccess)
product workflows
Elevation/file-access launch orchestration
⚠️ Warning: Do not edit. Invoked by events/UI; raw JSON is product code, not a settings surface.
Updater/installer jobs (keeper-updater, keeper-updater-prompt, keeper-installer, keeper-downloader)
product workflows
Update/download flows
⚠️ Note: Update/download automation, not a settings field.
Example/test jobs (custom-event-example, prelaunch-test)
examples
Non-production samples
⚠️ Note: Must never be treated as tenant-facing settings.
JvmAppLauncher launch parameters (Username, ExecutablePath, JavaPath, JarPath, MainClass, JvmArgs, AppArgs, WorkingDirectory, ClassPath, Elevate)
job-supplied per call
Per-invocation CLI parameters for launching a JVM app in a user's session
⚠️ Note: Populated per job call; equivalent to function-call arguments, not a persistent setting.
JobService bootstrap, category, and transaction-tracking fields
Job Scheduler / various
Job-manager plugin identity, lifecycle, and MQTT wiring
⚠️ Warning: Do not edit. Boot ordering and MQTT wiring are carefully chosen; reordering causes race conditions at startup.
KeeperPAM.metadata.mqttTopics / mqttRole
PAM topic graph
PAM ↔ System Extension MQTT bridge topics
⚠️ Warning: Do not edit. Wrong topics drop sudo-interception events.
KeeperPAM.metadata.transaction.enabletracking
false
PAM transaction tracking
⚠️ Note: Rare debug flag, not needed alongside the equivalent macOS System Extension setting.
KeeperPAM.executablePath
/Library/Keeper/lib/pam_keeper.so
PAM shared library path
⚠️ Warning: Do not edit. Installer/OS layout path — editing can break sudo interception on Linux/macOS.
KeeperPAM.autoStart / .requiresMonitoring / .autoRestart
false / false / false
PAM module lifecycle flags
⚠️ Note: Loaded by the OS PAM stack itself, not by KPM.
Elevation-chain helper bootstrap (KeeperRunAs, KeeperRunElevated, KeeperSudo, KeeperUSession, InstallLauncher, Keeper.NetworkConnections startup ordering)
various
Boot ordering for the elevation and helper-tool chain
⚠️ Warning: Do not edit. Ordering is carefully chosen for broker/API dependencies; reordering causes race conditions at startup.
Test-harness plugins (keeperlift, keepertalk)
disabled by default
Non-production GUI test clients
⚠️ Note: Must never be enabled from the console; these are internal test harnesses, not product features.
KeeperDmgMount bootstrap and launch mode
OnDemand / various
macOS DMG mount/install dialog lifecycle
⚠️ Note: Launched on demand by a job; not resident, no meaningful tenant setting beyond the Redirect rules above.
KeeperMessage bootstrap, UI flags, and message-level list
User / various
Message/notification dialog lifecycle and capabilities
⚠️ Note: Descriptive UI capability metadata, not a tenant policy decision.
Plugin Bootstrap & Shared Wiring
id
plugin id
Stable plugin identifier
⚠️ Warning: Do not edit. Renaming orphans storage and MQTT routing for that plugin.
name / description / version
product strings
Display metadata
⚠️ Note: Editing does not change behavior and will confuse Keeper support if reported.
pluginType
Executable / Service / …
How the loader starts the plugin
⚠️ Warning: Do not edit. Wrong type prevents the plugin from starting.
executablePath / debugExecutablePath
bin/...
Executable path under the install root
⚠️ Warning: Do not edit. Fixed by installer layout; edits break plugin launch after upgrades.
arguments
""
Command-line arguments passed to the plugin executable
⚠️ Warning: Do not edit. Free-form argument changes can disable security flags or break the process entirely.
supportedPlatforms
OS list
Platforms a plugin may run on
⚠️ Note: Build/installer concern — console toggles will not add a missing binary for another OS.
startupPriority
numeric
Boot ordering (lower starts earlier)
⚠️ Warning: Do not edit. Ordering is carefully chosen for broker/API dependencies; reordering causes race conditions.
autoStart
true/false
Whether the host launches the plugin at startup
⚠️ Warning: Do not edit. Some plugins must stay on-demand (elevation); flipping this can break elevation flows or leak sessions.
executionContext
Service / User
Account context for the process
⚠️ Warning: Do not edit. This is a security boundary (SYSTEM vs. user context).
requiresMonitoring / autoRestart
true/false
Health-monitoring inclusion and auto-restart behavior
⚠️ Note: Coupled to the Watchdog/PluginMonitoring settings listed above; availability policy should stay at product defaults.
modifiedAt
ISO timestamp
Last metadata change stamp
⚠️ Note: Bookkeeping field, not configuration.
enabled (where present)
true
Manifest enabled flag
⚠️ Warning: Do not edit. Overlaps with orchestration; editing this alone can leave the agent in an inconsistent state.
dependencies / requiredPermissions
arrays
Declared plugin dependencies / MQTT permissions
⚠️ Warning: Do not edit. Loader contracts, not tenant policy knobs.
Environment Variables & Platform Detection
KEEPER_JOB_ID
unset
Host-injected job correlation ID for a spawned job process
⚠️ Note: Bootstrap plumbing; injected automatically, not something an admin sets.
KEEPER_EXECUTION_ID
unset
Host-injected per-execution correlation ID
⚠️ Note: Same as above — correlation plumbing for logging/tracing.
KEEPER_INSTALL_LAUNCHER_SILENT
unset/falsy
Suppresses the installer launcher's stderr failure summary
⚠️ Note: Debug/console convenience flag only; does not change installer behavior or exit code.
HARDWARE_UUID
unset
Optional hardware-UUID entropy input to cross-platform encryption key derivation
⚠️ Warning: Security-sensitive cryptographic input. Do not set casually; consult Keeper support first.
PATH / HOME / USER / DISPLAY / SUDO_USER / LANG
OS-provided
Standard OS environment variables the agent reads incidentally
⚠️ Note: Not application settings — these are the operating system's own environment and should be managed at the OS level, not through Keeper.
KEEPER_MQTT_PORT
8883 (fallback)
Overrides the MQTT broker port used by standalone job/example clients
⚠️ Warning: Do not set this to change broker behavior. Use the MqttBrokerSettings:Port setting above; this variable only affects narrow example/job tooling.
Duplicate Configuration Copies
These settings are duplicate mirrors of settings already listed elsewhere in this document. Editing them separately can cause the agent to behave inconsistently ("split-brain" configuration).
Config\AiLikelihood*.json / SystemShellBasenames.json / AgenticChainIntermediaryBasenames.json (per-binary install-tree copies)
same as root Config
Per-binary copies of shared inventory/AI-detection configs
⚠️ Warning: Do not edit these copies. Change the canonical content files under Agentic / Intel above instead.
elevation-allowed-extensions.json (duplicate copies under KeeperClient and keeperAgent)
same allowlists
Per-UI-host copies of elevation extensions
⚠️ Warning: Do not edit these copies. Change the single setting under Client UI above instead.
InventoryFullConfiguration.json (duplicate under InventorySnapshotHarvest)
same as InventoryFull
Second copy of the inventory job configuration
⚠️ Warning: Do not edit this copy. Change the settings under Inventory above instead.
storage.basepath / storage.sharedrepositorypath (Admin API mirrors)
derived from Settings:RepositoryPath / Settings:SharedRepositoryPath
Resolved storage paths re-projected to every plugin
⚠️ Warning: Do not edit. Change Settings:RepositoryPath/Settings:SharedRepositoryPath under Service, Network & Messaging above instead.
justification.max_text_length (Admin API mirror)
mirrors Controls:maxJustificationTextLength
Justification-length cap re-projected to every plugin
⚠️ Warning: Do not edit. Change Controls:maxJustificationTextLength under MFA & Execution Grants above instead.
StorageConfiguration.BasePath / SharedPath
KeeperStorage / SharedRepository
Storage-engine binding of the base/shared paths
⚠️ Warning: Do not edit. Programmatic duplicate of the settings above.
DesktopDetectionConfig.DefaultLinuxDesktopProcesses / DefaultMacOSDesktopProcesses
same lists as the equivalent Session & Watchdog settings
Compile-time fallback process lists
⚠️ Note: Only used if configuration supplies none; the real, editable copy is under Session & Watchdog above.
Localization
Shared / component locale JSON (SharedLocales, LocaleValues, Keeper*Locales)
string tables
UI/localization dictionaries
⚠️ Note: Content localization pipeline; language choice is controlled by KeeperClient.metadata.LanguageOverride under Client UI, not by editing these string tables.
locale-cache-cleanup.json
cleanup job
Clears locale caches
⚠️ Note: Maintenance job graph, not a settings field.
Runtime & Encrypted State
These are outputs, snapshots, or internal engine tuning for the agent's encrypted storage — not settings an administrator sets. Do not edit files under these paths directly.
Encrypted KeeperStorage / SharedRepository contents
opaque
Unified encrypted settings/policy/credential store
⚠️ Warning: Never edit these files directly. Use the appropriate management API or policy tooling instead.
currentPolicies.json (under KeeperPolicy)
local policy snapshot
On-disk policy snapshot used by enforcement
⚠️ Warning: Do not edit. Derived from cloud/policy sync; edits bypass policy governance and will be overwritten.
Inventory / agentic mirror files (agent-application-inventory.json, checkpoints, hash caches)
generated
Generated inventory/AI mirror outputs
⚠️ Note: Outputs of scheduled jobs, not inputs — do not hand-edit.
intel-deploy-manifest.json (when present)
deploy metadata
Manifest describing which intel content blobs were deployed
⚠️ Note: Pipeline bookkeeping for content updates.
StorageConfiguration engine tuning (encryption scope, format, concurrency, retry, compression, streaming)
isolation on, User-level encryption, JSON format, 100 concurrent ops, 3 retries, etc.
Encrypted-storage engine internals
⚠️ Warning: Do not edit. Changing encryption or concurrency settings on live encrypted storage can corrupt or orphan tenant data.
JobStoreOptions.AllowedStorePathRoot / .MaxKeyLength / .MaxValueLength
app base dir / 512 / 65536
Path-traversal guard and key/value size bounds for the generic job key-value store
⚠️ Note: Internal safety bounds, not a fleet policy decision.
Research / Non-Production Tooling
These settings belong to an internal research prototype and offline content-fetch tooling. They are not part of the production agent's configuration surface and are listed here only so they are not mistaken for a supported setting if encountered in the repository or logs.
ControlPlane research rules store + CONTROLPLANE_* environment variables
research defaults
Research UI / data-service rules persistence
⚠️ Note: Separate research control plane. The production agent consumes the shipped intel/rules content listed under Agentic / Intel above.
ControlPlane normalized-feed working directory
research feeds
Research data-service intel directory
⚠️ Note: Production path is the agent's own intel/ / app-catalog content, not this research directory.
Offline intel-fetch/catalog-prototype tooling configuration
tool configs
Offline feed fetch/normalize tooling
⚠️ Note: Build/pipeline tooling, not an endpoint administration setting.
Last updated
Was this helpful?