Preloop 0.17.0: governing the devices and people behind your agents, plus local models and self-hosting
Preloop 0.17.0 shipped on 19 October 2026. Until now Preloop governed two things: the agents, and the models they call. Every governed request went through the gateway, where budgets, policies and audit applied. That covers the traffic. It does not tell you which laptop the traffic came from, who owns that laptop, or whether the agent on it is configured to go through Preloop at all.
0.17.0 is the first step toward governing that layer too: the devices agents run on and the people who own them. It is a first step, and I want to be precise about where it stops. But the shape is now in the product, and it changes what an administrator can answer.
The order we think about this in has not changed: cost first, then control, then compliance. Device governance belongs to the last two.
The Fleet Map
The Device fleet page has a new Map view next to its table, and instance administrators get the same map as an alternative to the inventory table on the Overview. It draws the people in the account, their machines, the agents on those machines, the models they call and the provider accounts behind them as one graph. Select any node and the map highlights everything that depends on it, with a side panel listing them: a provider credential leads to the agents that use it, the devices they run on and the people who own them. Gaps are marked where they sit: agents found on a device but not onboarded, runners offline, provider accounts that bypass the gateway.
The map is live. An activity window, from five minutes to any time, decides what is on it, so resources join and leave as they become active. Live traffic lights the connection it travels: an agent lights up when it sends a model request, the model lights up when it answers, an approval lights the agent in amber and the person who decides in green. Bubbles can say what happened. Pull requests opened, reviewed and merged show as counters on each agent, flow and person. Administrators can switch to a spatial arrangement, where people, machines and agents gather in islands around the models they share, and drag it into the shape of their team.
A device fleet you can see
Preloop Enterprise now has a device fleet console under Settings, People & access. Devices appear from personal runners or from opt-in agent discovery, without requiring you to maintain a roster first. If you do keep a roster of expected devices, the coverage view shows which ones have reported, which are stale, which reports match nothing on the roster, and which expected devices have never reported at all. Evidence is exportable as CSV.
Devices are linked to the rest of the product. An agent's page lists the devices it is associated with, and a device links back to its agents. A model's page now has a "Used by" list of the agents and flows configured to use it, including ones that have not sent their first request yet. So the question "which machines and which people are behind this spend on this model" is a few clicks, not a spreadsheet.
The console is deliberately careful about what it claims. A device that reports is not a device that is enforced. The page keeps runner state, collection, inventory, roster and verification separate, and states that self-reported evidence is self-reported.
Rolling it out with your MDM
The docs now include staged recipes for Jamf, Fleet, Intune (macOS and Windows) and Kandji to deploy the Claude Code managed configuration, plus secret-free export and inventory templates and an endpoint coverage and threat model guide. The guide is explicit about the difference between delivering a file and enforcing a control.
We also built a reproducible pilot that runs the real Claude Code app against Preloop's hook and checks that a denied action leaves no side effect. It passes the cooperative cases (allow, deny, fail-open versus fail-closed handling, rejected credentials, profile restoration). It also shows the boundary honestly: a user profile without the hook runs without asking anyone. That is exactly why device management matters, and why this is a first step. Acceptance testing against real MDM tenants and signed packaging are still open, and we will say so until they are done.
Personal runners, and the owner's consent
Personal runners put your own machine and your own agent seats to work for flows. Install one at login, and it runs as a per-user service on macOS, Linux and Windows (no elevation needed on Windows). The console shows its presence and the agent harnesses it has, and you can start a remote session on it from the console, including from a phone. GitHub Copilot CLI is the first harness with full support, followed by Claude Code. The runners ship with a written threat model and twelve numbered controls.
When the machine belongs to a person, that person gets a say. In 0.17.0 a flow on a personal runner asks its owner before it runs, by default. The owner can choose "ask me", "always" or "never". The same applies to managed agents: if another member of the account wants to start a new session on your agent, you are asked first. Approvals bind the exact request and are used once.
Administrators who need runners on certain machines can set personal runner requirements per role or team, with grace periods and report-only or warning enforcement, and see member compliance in the console.
Native host agents
Native host flows can now run Codex CLI, OpenCode and DeepSeek Harness directly on the runner host, alongside Claude Code, without Docker. Each adapter confirms that Preloop's tool gate is active before the task starts. If the gate does not come up, the task does not run, rather than running ungoverned.
Local models, governed
preloop runner models discovers models served on the runner's own loopback by Ollama, LM Studio, vLLM and llama.cpp, asks before registering them, and makes them available through the gateway. Requests to a local model keep the same authorization, policies, budgets and audit as any hosted model; the traffic travels to the runner over its existing connection. If the runner is offline you get a clear error. Nothing listens on a new port.
Self-hosting Preloop Enterprise
0.17.0 is a better release to run on your own infrastructure. Self-hosted deployments no longer inherit Preloop Cloud's hosted-model caps (your own budgets still apply), and self-hosted installs go straight to login instead of showing marketing pages. A new guide covers self-hosted GitLab end to end: token scopes, the project-hook fallback for GitLab CE, approval and merge-gate limits, webhook secrets and connectivity in both directions. Rehearsing it locally surfaced four integration bugs (custom ports and schemes, review comments on approvals among them), all fixed in this release.
Governance you can write in plain language
The governance policy is now something you can write or paste in plain language, with the measurable review thresholds in a visible form beside it, instead of rule blocks hidden in comments. The weekly governance review moved under Audit and was redesigned: findings come with evidence and drill-down, human approval decisions are separated from automatic ones, spend is shown per tool and per day, and account and personal email reports have their own switches. In Preloop Cloud and Enterprise, the review can also show the week's merged pull requests, issues and addressed review comments next to the spend, with the method and coverage stated, and work it cannot price stays unranked rather than guessed.
Two more control pieces: a visual resource access editor (permit by user, team, role or tag, with an explanation of why someone has access and a preview before saving), and a back-office policy pack for CRM, marketing, warehouse and CDN analytics MCP servers that notifies on unapproved servers, asks for approval on writes and deletes, and blocks bulk exports.
Also in 0.17.0
Claude Code analytics imported from the Anthropic Admin API into Cost as usage outside the gateway, without double-counting traffic Preloop already metered; budget denials return 429 on every gateway route; sensitive-data detectors now run on MCP tool arguments and results; Bitbucket Cloud publication and review follow-up for Copilot host flows; AWS Bedrock API key support; a dedicated remote Kubernetes cluster for hosted execution; and a long list of console speed-ups, including the agent page.
The full changelog is in the 0.17.0 release notes.