Endpoints With No Sensor

Some machines will never run an agent. They include a device whose firmware you do not control, a tablet, a contractor's laptop, an appliance on a factory floor, and an AI agent that is a process somewhere else. Each of those can still hold an identity, and much of what an operator needs does not come from the host.

What a resolve-only identity is

It is a registered address and a credential that can do exactly one thing: look names up. The console calls these devices, keeps them in their own view rather than in the fleet, and describes them as registered identities rather than managed endpoints. Each row shows the device, its address, its registry state and when it was enrolled. A state of confirmed means registered and not revoked, which says nothing about whether the machine is switched on right now.

There are two doors, and they lead to different places. "Protect a computer" installs the sensor on a machine you can reach, and the result lands in the fleet. "Add device" mints a resolve-only identity, and the result lands here. The operator console has both; device identities is what the identity itself is, and Devices is how to point a phone, a tablet or a locked-down machine at it.

What you get

An address anyone can check. The identity is published in DNS and in the public registry, with a pinned certificate and a signed reverse chain, and it is verifiable from any machine with no key and nothing installed. That is the part that does not depend on the endpoint cooperating: see verifying an identity.

A verdict at resolution. Every name the device looks up is answered by Whisper, which means it is answered against the graph: who runs that destination, and whether anything lists it. Policy applies at the same moment, so a name your estate does not allow is not answered. Resolver policy is the field list, and Coverage is how to read a clean answer.

A record of what it asked. DNS activity for the address is readable the same way it is for any host in your estate, which is often the only telemetry a device of this class will ever produce.

Containment that works. Both network-layer actions apply: flipping the address's default to deny, and revoking it outright. Neither needs anything on the machine, so both work on a device you cannot log into. Contain an endpoint is the procedure.

What the sensor adds

Process trees, file changes, hashes and on-host detections. That is the difference, and it is why your fleet reports sensor depth as depth of visibility rather than depth of protection. A resolve-only machine is covered at the network layer and unobserved on the inside, and knowing which of your rows are which is the point of keeping the two views apart.