What every agent in a protected system shares: downloads and checks the signed policy snapshots of its service, keeps the last one on disk, decides access with the policy engine and ships access events; runs on Java 8 with the engine, Jackson 2 and Bouncy Castle