Skip to main content

Enterprise Quickstart

Get Control Zero Self-Managed running in under 10 minutes. This guide takes you from download to your first governed AI action.

Prerequisites​

  • Linux host (Ubuntu 22.04+, Debian 12+, RHEL 9+, or similar)
  • Docker 24.0 or later
  • Docker Compose 2.20 or later
  • 4 GB RAM minimum (8 GB recommended)
  • 10 GB available disk space
  • A Control Zero enterprise license key (czs_...)

Step 1: Download czctl​

Download the czctl CLI for your platform:

curl -fsSL https://get.controlzero.ai/czctl | sh

Verify the installation:

czctl version

Step 2: Initialize the installation​

Set your license key as an environment variable before initializing. Your license key was provided in the welcome email. It starts with czs_.

export CZ_LICENSE_KEY=czs_<your-key>

Run the quickstart initialization. This generates configuration files, pulls container images, and validates your environment in one step:

czctl init --quickstart

The --quickstart flag uses sensible defaults for a single-host deployment:

  • Gateway on port 8443
  • Management API on port 8080
  • Dashboard on port 443
  • Default log level: info
  • Audit log retention: 90 days

You can customize these settings later by editing config/controlzero.env and docker-compose.yml.

Step 3: Start the services​

docker compose up -d

Wait for all services to become healthy (typically 30-60 seconds):

czctl status

You should see all services reporting healthy.

Step 4: Run postflight checks​

Verify the installation:

czctl postflight

All checks should pass. If any check fails, see Troubleshooting for common fixes.

Step 5: Open the dashboard​

Open your browser and navigate to:

https://<your-host>

Accept the self-signed certificate warning (or deploy a trusted certificate -- see SSL Proxy Setup).

Step 6: Register the admin account​

On first access, the dashboard presents the admin registration form:

  1. Enter your name and email address
  2. Set a strong password
  3. Confirm the registration

This creates the first administrator account. Additional users can be invited from Settings > Team.

Step 7: Create a project​

From the dashboard:

  1. Click New Project
  2. Enter a project name (e.g., "Production AI Agents")
  3. Click Create

Step 8: Generate an API key​

Inside your new project:

  1. Navigate to Settings > API Keys
  2. Click Generate Key
  3. Copy the key (format: cz_live_...) -- it is shown only once

Step 9: Install the SDK​

Install the Control Zero SDK in your application:

Configure the Control Zero registry once: add @controlzero:registry=https://npm.controlzero.ai to your .npmrc (or run npm config set @controlzero:registry https://npm.controlzero.ai). It applies to npm install and npx for the whole @controlzero scope.

# Python
pip install controlzero

# Node.js
npm install @controlzero/sdk

Step 10: Your first governed action​

Add Control Zero to your AI agent code. Here is a minimal Python example:

from controlzero import Client

cz = Client(policy_file="controlzero.yaml")

# Evaluate a policy before executing an action
decision = cz.guard(
    "database",
    method="query",
    args={"table": "users_table"},
)

if decision.effect == "allow":
    # Proceed with the action
    print("Action allowed by policy")
else:
    print(f"Action denied: {decision.reason}")

Run your application. You should see the policy evaluation appear in the dashboard audit log within seconds.

What's Next​

  • Define policies: Create governance policies in the dashboard to control what your AI agents can do
  • Configure the gateway: Route LLM API calls through the gateway for automatic policy enforcement -- see Architecture
  • Set up the SSL proxy: Enable DLP for browser-based AI chat -- see SSL Proxy Setup
  • Deploy Scout: Monitor shadow AI usage across your network -- see Overview
  • Review logging: Configure log levels and SIEM integration -- see Logging