Start here

From signing in for the first time to the first delivery in the fleet view. You need the hub’s address, an email address, and a machine where your agents run with the Common Measure edge (commonmeasure) 0.4.1 or later installed (installation). Use a new test directory and public or synthetic inputs for your first delivery. The edge works without a hub: nothing here is needed to record and enforce policy on one machine.

What the hub adds is coordination across an organisation’s machines: one policy an owner publishes and every enrolled machine applies, and one view of the evidence those machines have cleared for reporting. The hub is never in the path of a decision: each machine enforces its policy locally, and an unreachable hub never relaxes it.

Your organisation is a tenant of the shared hub service, not a separate server, and can enrol several edges. This walkthrough enrols an edge on your own machine. An organisation’s hosted edge, which people reach from Word, is enrolled once by an administrator; each person signs in from the host to use it and enrols nothing. A hosted edge keeps its private record in the service’s storage, not on the person’s computer.

1. Sign in

Open the hub’s address and choose Sign in. Enter your email address alone, without a display name or quotes (internationalised local parts are not supported), and choose Email me a sign-in link. The hub emails a link that works once and expires after 10 minutes; open it, check that the button reads Sign in as followed by your address, and choose it. Where the hub offers Continue with Google, it works too, for a Google account whose address Google has verified.

The hub is open to admitted addresses: yours once Common Measure has admitted it, or your organisation’s domain, or an address an owner has invited. The first sign-in with an admitted address creates your account. The hub gives the same answer for any address, “If this address has access, a sign-in link is on its way”, and sends a link only to an admitted one. If no link arrives, join the waiting list; when you are admitted, an email links you to the sign-in page with your address filled in.

When sign-in began from a hosted client such as Copilot, the connection request is kept in the browser or window where it began, for 30 minutes. Trying again from the check-email page or from an expired link keeps it. Completing sign-in in another browser signs that browser in and opens the dashboard; the connection continues only where it began.

An app’s own sign-in window, such as the one Word opens, does not share a sign-in with your browser. If the emailed link opens in your browser instead of that window, the page it opens says so and offers Copy sign-in link: copy the link without continuing, paste it into Sign-in link in the app’s window and choose Open link in this window. The hub asks you to confirm the link there as usual. A link already used in the browser cannot be used again; choose try again in the app’s window for a new one. Completing a connection from Word’s own window has not yet been verified.

Sign-in is limited so that it cannot be used to flood the hub or an inbox: three links to one address in 15 minutes and ten in a day, ten link requests from one network address in 15 minutes, and 30 sign-in attempts from one network address in 15 minutes. A refused request says which limit it reached and how long to wait.

2. Create your organisation

An account with no organisation opens on Create your organisation. Enter the organisation’s name and choose Create organisation. You become its owner, and the hub opens Policy on the organisation’s first policy revision (step 3). One person can create at most three organisations in 24 hours.

The trial is free. Owners invite colleagues from Team; an invitation lets the colleague sign in even if their address was not admitted. One person can send ten invitations in 24 hours, and one organisation 25. Each person’s machine is enrolled for them (step 3), and removing someone on Team revokes their machines’ keys and ends their access. Revoking a pending invitation records the owner, invite address and role in the audit log.

If someone has already invited you to their organisation, open the invite link instead; you join their organisation and skip this step. If the hub asks you to sign in first, it returns you to the invite in the same browser. If you open the sign-in link in a different browser, open the invite link again there.

Finding your way around

The sidebar groups links by task, in this order:

• Record and policy: Fleet evidence; owners also see Policy and Project reporting.
• Connections: Connected clients and Suppliers; owners also see API keys and Hosted edge.
• Organisation: Team; owners also see Retention.
• Network: Onward delivery (with Content owners under it), Received reports, Marketplace and Extension Studio (extension guide).
• Platform, for super-admins: Platform, Marketplace review and Design reference.

Network and Platform start closed. Open either group to see its links; the browser remembers your choice. The current page’s group stays open. On a tablet or small screen, choose Menu to reach the same groups.

Docs, at the bottom of the sidebar or in the header on small screens, opens the guide for the current screen in a new tab.

Use Collapse sidebar at the top of the sidebar to make more room for your work. All navigation icons remain available; hover or focus an icon for its label. The button stays available to expand the sidebar again.

Open the Account menu beside Docs at the bottom of the sidebar, or in the header on small screens, for account settings, organisation switching, Appearance and sign-out. The organisation switcher appears when you belong to more than one organisation. The Hub starts in Light; choose Dark or System under Appearance to remember a different preference.

3. Mint an enrolment token

A new organisation already has a policy. When the hub creates the organisation it publishes revision 1:

{ "policy_mode": "observe" }

Policy opens on that revision, published by Common Measure Hub at organisation creation. In observe mode an edge records each source an agent reads and refuses none for the policy’s own rules; private-network restrictions still apply, and the terms a source sets bind on every enrolled edge in every mode. Reporting needs project enrolment and owner approval, in step 6. Prompts, answers, internal-source content and the engagement name stay local.

Choose Enrol your first edge, or open API keys. Under Enrol an edge, enter a name for the edge, choose its member and choose Mint enrolment token. The name is your label in the fleet view. The page prints the command to run:

commonmeasure connect <the hub's address> --token et_… --managed

Use the actual command the page prints; the address and token above are placeholders. The token works once and expires after 15 minutes. Connect an edge covers tokens that expire or are cancelled.

4. Connect the edge

The edge may already have a local policy. Review it before opting into hub management: the managed policy becomes the policy for that edge. Use a test edge if existing work requires different rules.

Run the printed command on the machine where your agents run, as the user the edge runs as. It exchanges the token for an ingest key, stores it in ~/.commonmeasure/relay.json without printing it, creates the edge’s signing key and registers the public half. --managed pins the hub’s policy signer and synchronises the organisation’s current policy revision: revision 1 on a new organisation.

Check that the command succeeds and names the intended organisation and policy revision. A successful enrolment alone is not a successful policy sync. An organisation with no published revision shows No published policy on Policy; an owner publishes one there with Create policy, and the edge then takes it with commonmeasure policy sync. Do not reuse the spent enrolment token. Connect an edge covers other failures.

The first relay normally has nothing from a new test directory. Enrolling an already used project with --include-history and approving reporting can deliver its existing eligible records on the next relay run. Start with a new directory and review the output of commonmeasure relay --dry-run (step 6) before sending.

5. Edit the organisation’s policy

Members enrol projects on their own machines; you approve them under Project reporting. No directory path is needed in the policy. Step 6 selects a new test project for your first delivery.

Revision 1 is enough for the first delivery. To add source rules, open Policy and choose Edit policy, or Guided setup to build a replacement draft step by step. Policy distribution explains strict source rules and other controls.

Under Test a source, choose Add a trial and enter a directory and a public source URL. Choose Review changes to validate the draft and run the check. With no directory scopes, the default rules apply in every directory; the trial checks source admission, not reporting approval. Inspect the changed values and source result, then choose Publish. The draft becomes revision 2; each managed edge applies it on its next policy fetch, and commonmeasure policy sync fetches it at once. Creating an account or minting a token makes no reporting choice for you.

Advanced: a firm-wide path convention

Use path rules only when a convention must hold on every machine. For example, to refuse sources and keep work local wherever the path contains /clients/, add this scope in Full policy JSON, or use Add a path rule (advanced) → Add confidential directory in guided setup:

{
  "policy_mode": "observe",
  "scopes": [
    {
      "match": "/clients/",
      "policy_mode": "strict",
      "constraints": [{ "kind": "access_rule", "host": "*", "action": "refuse" }],
      "allow_telemetry_egress": false
    }
  ]
}

Path matches are substrings and the first matching scope wins. Test a matching and an unrelated directory before publishing a path rule. Keep confidential scopes before broader reporting scopes; an owner’s project approval cannot override a confidential scope.

6. Enrol a project, approve reporting, then work

Create a new test directory containing only public or synthetic inputs. Members can enrol each project with /commonmeasure:enrol (Claude Code plugin) or $commonmeasure-enrol (Codex), or ask their agent to enrol the project; with commonmeasure install claude the MCP server offers context_enrol instead (member setup). For this walkthrough, run the CLI command from your new test directory:

commonmeasure enrol --name "Acceptance project" --reporting hub --include-history

On a machine enrolled to you, an owner, the request is approved as it is made and Project reporting lists it as “Self-approved (owner)”. On a member’s machine the command answers with "reporting": "approval_pending"; an owner opens Project reporting, checks the project name with its operator and chooses Approve reporting. On the edge, run commonmeasure enrol --sync and check that reporting is permitted before working. The approval covers the selected directory and its descendants, including existing eligible records. Related Git worktrees are enrolled separately. Enrol a project explains approval expiry and opting out.

Work a session in your agent host from inside the selected test directory, with Common Measure registered in the host (commonmeasure install claude registers it with Claude Code). Pages the agent fetches through Common Measure’s fetch tool, context_fetch, are recorded on the machine. To see what would leave without sending anything, run:

commonmeasure relay --dry-run

It prints the events and batches it would deliver and the source hosts that would leave. Then run:

commonmeasure relay

The relay delivers eligible records from the approved directory to the hub and reports how many events it delivered and how many were new at the hub. Run it whenever you want the hub to catch up. A delivery that fails stays on the machine and is sent on the next run.

7. Read the first delivery

Open Fleet evidence. After the first delivery it shows:

• Retrieved and Grounded for the last 30 days: pages fetched, and pages whose text went into the model’s context.
• Recent sessions: the 50 most recently seen sessions, among them the edge’s, with the edge’s key id as its agent, its event counts, the ingest key named after the edge, and the relay version that delivered it.
• Top source hosts: the 20 sites most pages came from in the last 30 days.

Prompts, answers, page content, engagement names and the addresses and reasons of refused fetches stay local. A refused count accompanies sessions that deliver events. Fleet evidence describes the view in full, API keys the keys the edge now holds, and the bot identity what publishers see of the enrolled edge.