This guide walks through verifying that the full policy delivery chain works: CLI → API → device agent picks up the change.
Prerequisites
agent-charley-cli installed (see Getting Started)- An API key with
read_write scope
- At least one active enrolled device (see Devices)
Step 1: Verify Authentication
agent-charley-cli --verbose plan --file /dev/null 2>&1 | head -5
401, the key is wrong or expired.
A simpler smoke test — pull current server policies:
agent-charley-cli pull --output /tmp/current.yaml && echo "Auth OK"
Step 2: Get Your Device ID
From the dashboard: Devices → find your test device → copy the UUID shown under the name.
Or via the API:
curl -s https://dash.charlemagnelabs.ai/api/devices \
-H "x-api-key: $CHARLEY_API_KEY" | python3 -m json.tool | grep device_id
export TEST_DEVICE_ID=<your-device-uuid>
Step 3: Check the Current Effective Policy
agent-charley-cli effective $TEST_DEVICE_ID
Step 4: Create a Test Policy File
Create test-policy.yaml with a change you can verify on the device. A safe, visible test is toggling suppress_frontend_ui or flow_logs_enabled:
- name: Test Policy
type: app_config
scope: device
target: <your-device-uuid>
locked: false
data:
flow_logs_enabled: true
suppress_frontend_ui: false
<your-device-uuid> with your $TEST_DEVICE_ID.
Step 5: Plan
agent-charley-cli plan --file test-policy.yaml
Plan: 1 to create, 0 to update, 0 to delete, 0 unchanged.
--- /dev/null
+++ Test Policy (device/<uuid>/app_config)
@@ ...
0 unchanged with no diff, the policy already matches what’s on the server.
Step 6: Apply
agent-charley-cli apply --file test-policy.yaml -y
Plan: 1 to create, 0 to update, 0 to delete, 0 unchanged.
Done.
Step 7: Confirm Delivery to Device
The device agent polls for policy updates periodically. After applying, verify that the device has received the new policy.
Option A — Check via CLI:
agent-charley-cli effective $TEST_DEVICE_ID
~/Library/Application Support/AgentCharley/dlp_watchdog_policy.json
cat ~/Library/Application\ Support/AgentCharley/dlp_watchdog_policy.json
Step 8: Test a DLP Policy
To test DLP end-to-end on a device where Agent Charley is running:
- Apply a DLP policy with
mode: warn and builtins: [credit_card].
- On the test device, open any text editor or browser form.
- Copy a test card number (use a Luhn-valid test number, e.g.
4111 1111 1111 1111) to the clipboard.
- Paste it.
- You should see a warning toast notification from Agent Charley.
Switch mode to block and repeat — the paste should be prevented and the clipboard cleared (if clear_clipboard_on_block: true).
Step 9: Clean Up
Delete the test policy after confirming delivery:
agent-charley-cli apply --file /dev/null --prune -y
--prune will delete all server policies not in the file. If your org has other policies, pass an empty file only in a test org, or delete the specific policy by listing all policies (agent-charley-cli pull) and removing just the test one.
Common Issues
| Symptom | Likely Cause |
|---|
401 Unauthorized | Wrong or expired API key |
403 Forbidden | Read-only key used for apply |
404 Not Found on group target | Group doesn’t exist yet — run apply --groups groups.yaml first |
Policy shows in effective but device hasn’t changed | Agent is still on its poll interval; wait ~60 seconds |
Failed to load policies | YAML parse error — check indentation (use 2-space indent) |
| Plan shows no changes when you expect some | The local file already matches server state — pull to verify |
Testing Against Dev Environment
agent-charley-cli --env dev plan --file test-policy.yaml
agent-charley-cli --env dev apply --file test-policy.yaml -y
CHARLEY_ENV=dev to avoid repeating the flag. 
