Test a deployment

Before rolling out, set everything on one test Mac and one test Windows PC and check each control. About half an hour. You need administrator rights on both, Verbiqo installed, and your AI service reachable.

Before you start

The command line tool. verbiqo policy template must print a policy. If verbiqo is not installed, use the app’s own copy: /Applications/Verbiqo.app/Contents/Helpers/verbiqo. Or click the Verbiqo icon and choose Install Command Line Tool…
Your AI service details: the endpoint exactly as it appears in Settings, and the model name.

1. Make a test policy

mkdir verbiqo-policy-test && cd verbiqo-policy-test
verbiqo policy keygen policy-private.pem policy-public.pem
verbiqo policy template > policy.json

Edit policy.json:

inference.endpoint: your endpoint, character for character.
inference.protocol: openai-chat-completions if the endpoint ends in /chat/completions; otherwise, for the OpenAI-compatible provider, openai-responses. ollama-chat for Ollama.
allowedModels: your model name.
extensions.allowed: ["prom"]. features.allowed: ["rewrite", "ask"]. Keep the rule that blocks credential.

Then:

verbiqo policy sign policy.json policy-private.pem policy-signed.json
verbiqo policy check policy-signed.json policy-public.pem

The check should say the signature is valid and list exactly what you set.

2. Apply it on the Mac

Copy the policy and key where Verbiqo can read them but people cannot change them:

sudo mkdir -p "/Library/Application Support/Verbiqo"
sudo cp policy-signed.json policy-public.pem "/Library/Application Support/Verbiqo/"
sudo chmod 644 "/Library/Application Support/Verbiqo/"*

Then set the managed settings with a configuration profile, the same way device management does. Save this as Verbiqo-test.mobileconfig, with your provider, endpoint and model (the endpoint exactly as in the policy) and your policy ID:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>PayloadDisplayName</key><string>Verbiqo test settings</string>
  <key>PayloadIdentifier</key><string>com.verbiqo.test</string>
  <key>PayloadType</key><string>Configuration</string>
  <key>PayloadScope</key><string>System</string>
  <key>PayloadUUID</key><string>6F1C0E5A-0D7B-4C1E-9A43-2B8E7D1F0A01</string>
  <key>PayloadVersion</key><integer>1</integer>
  <key>PayloadContent</key>
  <array>
    <dict>
      <key>PayloadIdentifier</key><string>com.verbiqo.test.settings</string>
      <key>PayloadType</key><string>com.apple.ManagedClient.preferences</string>
      <key>PayloadUUID</key><string>6F1C0E5A-0D7B-4C1E-9A43-2B8E7D1F0A02</string>
      <key>PayloadVersion</key><integer>1</integer>
      <key>PayloadContent</key>
      <dict>
        <key>com.verbiqo.app</key>
        <dict>
          <key>Forced</key>
          <array><dict>
            <key>mcx_preference_settings</key>
            <dict>
              <key>provider</key><string>openai</string>
              <key>ollamaURL</key><string>https://ai-gateway.example.internal/v1/chat/completions</string>
              <key>model</key><string>qwen3-30b-instruct</string>
              <key>timeoutMilliseconds</key><integer>300000</integer>
              <key>contextTokens</key><integer>32768</integer>
              <key>privacyPolicyPath</key><string>/Library/Application Support/Verbiqo/policy-signed.json</string>
              <key>privacyPolicyPublicKeyPath</key><string>/Library/Application Support/Verbiqo/policy-public.pem</string>
              <key>privacyPolicyID</key><string>example.verbiqo</string>
              <key>privacyReceiptPath</key><string>/Users/Shared/verbiqo-receipts.jsonl</string>
            </dict>
          </dict></array>
        </dict>
      </dict>
    </dict>
  </array>
</dict>
</plist>

If your AI service uses your organization’s own certificate, add tlsTrustedCA with the CA file’s path. Replace the two PayloadUUID values with your own (run uuidgen twice): each profile needs IDs of its own. Check the file with plutil -lint Verbiqo-test.mobileconfig, then install it:

Open it
Double-click the file. macOS says the profile was downloaded.
Install it
System Settings › General › Device Management (on older macOS, Privacy & Security › Profiles): open Verbiqo test settings, choose Install and enter your password.
Check it arrived
defaults read com.verbiqo.app ollamaURL prints your endpoint. Quit Verbiqo and open it again.

3. Apply it on Windows

Copy policy-signed.json and policy-public.pem to C:\ProgramData\Verbiqo\, then save this as verbiqo-test.reg and run reg import verbiqo-test.reg as an administrator:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Verbiqo]
"Provider"="openai"
"Endpoint"="https://ai-gateway.example.internal/v1/chat/completions"
"Model"="qwen3-30b-instruct"
"TimeoutMilliseconds"=dword:000493e0
"ContextTokens"=dword:00008000
"PolicyPath"="C:\\ProgramData\\Verbiqo\\policy-signed.json"
"PublicKeyPath"="C:\\ProgramData\\Verbiqo\\policy-public.pem"
"PolicyId"="example.verbiqo"
"ReceiptPath"="C:\\ProgramData\\Verbiqo\\receipts.jsonl"

Quit Verbiqo from its icon by the clock and open it again.

4. Check each control

On both computers:

Do	Expect
Open Settings	Provider, endpoint, Trusted CA, model, timeout and context window are greyed out; hovering says Managed by your administrator. The button reads Test Connection: it says your model is available and does not change it. The privacy policy shows as managed. Nobody was asked to confirm the endpoint.
Ask hello	An answer from your AI service.
Select text and choose a rewrite	It works: Rewrite is allowed.
Choose Explain, or Summarize Document	Refused: Your organization’s privacy policy does not allow … Permitted: Rewrite, Ask.
Open Extensions	Only Prometheus. In Ask, `/pg` is refused.
Ask is this ok: password=Hunter2-test-123	Blocked before sending: the policy blocks credentials.
Open the receipts file	One line per request with the decision and rule IDs, and none of what you typed.
If you set `licensePath`: open Settings › Licence	Your licence, followed by Managed by your administrator; Import and Deactivate are off. `verbiqo licence seats team.verbiqo-license` lists this computer’s device ID.
If you set the embedding service: open Extensions › Prometheus	Under Semantic index, the endpoint and model are your values, greyed out; Use the model’s API key is set as you chose. Build Index works with only the person’s own API key entered in Settings.

5. Check it fails safely

Do	Expect
Change one character inside the deployed `policy-signed.json` (with `sudo`), then ask anything	Every request stops with a message naming the organization policy; no system can be read. Put the file back afterwards.
Add `"pg"` to `extensions.allowed`, and sign, copy and check it as revision 2 (Change a policy); open Ask again	Without restarting, `/pg` is offered alongside `/prom`.
Then put revision 1 back and ask something	Revision 1 is refused as older than one already accepted.
With Verbiqo running, remove the profile (Windows: delete the registry key), wait half a minute and open Settings and Extensions	Everything is editable and every system is back, without restarting. Put it back: within half a minute it is managed again.
Set the managed timeout to `5` (Windows `TimeoutMilliseconds`, Mac `timeoutMilliseconds`) and restart Verbiqo	Verbiqo starts normally; the timeout is the person’s own and not locked. Set it back.

6. Remove the test settings

# Mac: System Settings › General › Device Management, select
# "Verbiqo test settings" and remove it. Then:
sudo rm -r "/Library/Application Support/Verbiqo"

# Windows, as an administrator
reg delete "HKLM\SOFTWARE\Policies\Verbiqo" /f

Restart Verbiqo: Settings is editable again and each person’s own values return.