---
title: "Profiles and policies"
description: "Write a profile, aim it at a group of endpoints, and see what the Agent enforced and what it could not."
url: "https://support.outpostplatform.com/guides/profiles-and-policies/"
product: "depot"
type: "how-to"
status: "stub"
ai_summary: "Guide to Outpost profiles and policy enforcement. A profile is a set of policy values assigned to endpoints and enforced by the Agent. Covers writing one, assignment and merge order, drift and remediation, the settings audit chain, retention and disk encryption key escrow."
source: "https://gitlab.com/outpostplatform/docs/-/edit/main/src/content/docs/guides/profiles-and-policies.md"
license: "CC BY 4.0"
---

# Profiles and policies

A profile is how you say what a managed endpoint should look like, and the Agent
is what makes it look that way and reports when it cannot. This guide covers
writing a profile, deciding what wins when two apply, and reading the result. It
is for the administrator responsible for how machines are configured.

<!-- TODO: write this page against the how-to template.

Sections:

- Before you begin: a group of endpoints to aim at, and the policy
  permissions.
- What a profile is, and what a policy value is inside one.
- Create a profile and set your first values.
- Assign it, and the order profiles merge in when more than one applies.
- What the Agent does on receipt, and how quickly.
- Reading enforcement results: applied, drifted, refused, and why.
- The settings audit chain: every change recorded, and how to read it back.
- Retention, and how long enforcement history is kept.
- Disk encryption key escrow, and recovering a key.
- If something goes wrong: a value that will not stick, and an endpoint that
  reports nothing back.
-->

Follow the [how-to template](https://gitlab.com/outpostplatform/docs/-/blob/main/templates/how-to.md).