# North Pole Security

> Proactive endpoint protection for macOS. North Pole Security builds Workshop, a control plane for Santa, and maintains the Santa open-source binary and file-access authorization agent.

This file is a machine-readable index of every public page on northpole.security, following the llmstxt.org standard. Every link points at the raw markdown (.md) mirror of the page; strip the `.md` suffix to reach the human-readable HTML version (the homepage's HTML lives at `/`).

See also:
- /llms-full.txt: concatenated full text of every documentation and blog page
- /docs/santa/llms.txt: Santa documentation only
- /docs/workshop/llms.txt: Workshop documentation only

## Product

- [North Pole Security](https://northpole.security/index.md): Proactive endpoint protection for macOS. Built by the creators of Santa, Workshop makes allowlisting practical at enterprise scale.
- [Workshop](https://northpole.security/workshop.md): North Pole Security's flagship platform. A control plane for Santa with approval workflows, package rules, risk engine, telemetry, and USB/SD blocking.
- [Santa](https://northpole.security/santa.md): Open-source binary and file-access authorization for macOS. The foundation Workshop is built on, maintained by North Pole Security.
- [About](https://northpole.security/about.md): Company background, founding team, mission, and the story behind the Santa project.
- [Contact](https://northpole.security/contact.md): Contact form for sales, support, and general inquiries.
- [Cookbook](https://northpole.security/cookbook.md): Recipes for common allowlisting and rule-authoring patterns in Workshop and Santa.

## Features

- [Features overview](https://northpole.security/features.md): Index of Workshop's capabilities for managing Santa fleets.
- [AI chat](https://northpole.security/features/ai-chat.md): Conversational interface for investigating events, building rules, and answering policy questions across a Santa fleet.
- [Approval workflows](https://northpole.security/features/approval-workflows.md): Structured request and approval flows for adding new binaries, packages, and rules without slowing users down.
- [Endpoint privilege management (beta)](https://northpole.security/features/endpoint-privilege-management.md): Remove standing local admin rights and grant time-boxed, audited just-in-time elevation from the Santa menu bar.
- [Execution rules](https://northpole.security/features/execution-rules.md): Binary, certificate, Team ID, and signing-ID rules with rich precedence so Workshop can express realistic enterprise policy.
- [File-access authorization](https://northpole.security/features/file-access-authorization.md): Control which processes can read or write sensitive files, layered on top of Santa's execution policy.
- [Network rules (beta)](https://northpole.security/features/network-rules.md): Allow, deny, or audit network connections by process identity, destination, port, and protocol across the fleet.
- [Package rules](https://northpole.security/features/package-rules.md): Author allowlist rules at the package level instead of one binary at a time, so updates don't break policy.
- [Removable media blocking](https://northpole.security/features/removable-media-blocking.md): Block or restrict USB drives, SD cards, and other removable storage to prevent data exfiltration.
- [Risk engine](https://northpole.security/features/risk-engine.md): Scores and explains the risk of unknown binaries so reviewers can make fast, well-informed approval decisions.
- [Social voting](https://northpole.security/features/social-voting.md): Peer-driven approval voting to scale allowlist review across a large fleet without bottlenecking on a central admin.
- [Telemetry](https://northpole.security/features/telemetry.md): Rich, structured logs of every relevant macOS event with first-class export pipelines to SIEMs and data warehouses.

## Workshop documentation

- [Introduction](https://northpole.security/docs/workshop/index.md): Welcome to Workshop, the comprehensive administration console for managing Santa deployments across thousands of hosts.
- [AI](https://northpole.security/docs/workshop/ai.md): Workshop provides AI-powered features to help you manage and understand your endpoint security environment.
- [API](https://northpole.security/docs/workshop/api.md): The Workshop API uses Connect RPC for protobuf-based RPC.
- [Approval Workflows](https://northpole.security/docs/workshop/approval-workflows.md): A powerful feature of Workshop is the ability to delegate approvals decisions across your organization when running in Lockdown mode.
- [Audit](https://northpole.security/docs/workshop/audit.md): Every change made to Workshop, whether by UI or API, is recorded in the audit logging system. This provides a complete record of all actions taken in your Workshop deployment for security,…
- [Binary Upload](https://northpole.security/docs/workshop/binary-upload.md): Workshop can pull a copy of a binary off an enrolled host and store it in your own cloud storage bucket.
- [Event Export](https://northpole.security/docs/workshop/event-export.md): Workshop can automatically export events to cloud storage for long-term retention, compliance requirements, or integration with external SIEM systems and analytics platforms.
- [Events](https://northpole.security/docs/workshop/events.md): The Events interface provides visibility into events across your Santa-protected fleet. This feature lets administrators track, analyze, and respond to what Santa saw and decided throughout your…
- [Filter Language](https://northpole.security/docs/workshop/filter-language.md): Most Workshop API methods that begin with `List` (e.g., `ListHosts`, `ListRules`, `ListEvents`) support filtering results using a standardized filter language.
- [Hosts](https://northpole.security/docs/workshop/hosts.md): The Hosts interface provides a comprehensive view of all endpoints running Santa across your organization.
- [Linux Telemetry Schema](https://northpole.security/docs/workshop/linux.md): {/* Code generated from the telemetry schema by github.com/northpolesec/sleigh/cmd/schemadoc. DO NOT EDIT. */}
- [Multi-Party Approval](https://northpole.security/docs/workshop/mpa.md): Multi-Party Approval (MPA) adds an additional layer of security by requiring multiple administrators to approve sensitive actions before they are executed.
- [Reports](https://northpole.security/docs/workshop/reports.md): The Reports interface provides comprehensive insights into your Santa deployment, helping administrators understand security posture, rule effectiveness, and system health across the organization.
- [Risk Engine](https://northpole.security/docs/workshop/risk-engine.md): The Risk Engine empowers security teams to create policies that automatically identify when applications exceed your organization's risk tolerance.
- [Rules](https://northpole.security/docs/workshop/rules.md): Workshop provides comprehensive rule management for controlling system behavior across your organization.
- [Settings](https://northpole.security/docs/workshop/settings.md): The Settings interface provides a centralized control panel for configuring Workshop's global settings that affect all hosts in your organization.
- [Slack](https://northpole.security/docs/workshop/slack.md): Included with Workshop is a Slack chat bot that can help users go through an approvals workflow in Slack.
- [Tags](https://northpole.security/docs/workshop/tags.md): Tags are a flexible mechanism for assigning rules and settings to hosts.
- [Telemetry](https://northpole.security/docs/workshop/telemetry.md): Workshop provides powerful telemetry capabilities for analyzing Santa security events. The telemetry system integrates with Santa's telemetry collection to store and enable querying of detailed…
- [Webhooks](https://northpole.security/docs/workshop/webhooks.md): Workshop can POST events to an HTTPS endpoint of your choosing as they happen, letting you forward Workshop activity into your own systems — SIEMs, ticketing, chat, or custom automation.
- [API Keys](https://northpole.security/docs/workshop/api/api-keys.md): The API Keys interface provides a way to create and manage API keys for programmatic access to Workshop.
- [RPC Log](https://northpole.security/docs/workshop/api/rpc-log.md): The RPC Log records every API request the web UI makes during your browser session, so you can inspect exactly what the UI sends and replay any call from the command line.
- [Bucket Setup](https://northpole.security/docs/workshop/binary-upload/bucket-setup.md): Binary upload stores files in your own cloud storage bucket. For each request, Workshop mints a short-lived presigned URL, and the host uploads straight to the bucket. Workshop never holds the file.
- [Filter Expressions](https://northpole.security/docs/workshop/binary-upload/filter-expressions.md): Binary upload filter expressions are CEL expressions that Santa runs on the host before an upload. A match drops the upload, so the file never leaves the machine.
- [CEL Guide](https://northpole.security/docs/workshop/rules/cel-guide.md): CEL (Common Expression Language) lets you attach a small program to a binary authorization rule. Instead of a static allow/block, the rule's decision is the program's return value, evaluated when a…
- [Execution Rules](https://northpole.security/docs/workshop/rules/execution-rules.md): The Execution Rules interface provides a comprehensive view of all rules that control execution of binaries across your organization.
- [File Access Rules](https://northpole.security/docs/workshop/rules/file-access-rules.md): File Access rules enable Santa to control which processes can read and write files on macOS systems. This powerful feature allows administrators to monitor, log, and block file access attempts based…
- [Network Rules](https://northpole.security/docs/workshop/rules/network-rules.md): Network rules let Santa authorize, deny, or audit network connections on macOS hosts. Rules match flows by the local process, the remote peer, and the transport (ports, protocols, direction), and…
- [Package Rules](https://northpole.security/docs/workshop/rules/package-rules.md): A package rule targets a piece of software by name in a package catalog (for example a Homebrew cask or an npm package) rather than by a raw hash or Team ID.
- [Rule Packs](https://northpole.security/docs/workshop/rules/rule-packs.md): Rule Packs are curated sets of rules, maintained by North Pole Security, that you can subscribe to instead of authoring and maintaining the rules yourself.
- [Sandbox Rules](https://northpole.security/docs/workshop/rules/sandbox-rules.md): A Sandbox rule is an execution rule whose policy is **Seatbelt**. Instead of allowing or blocking the binary outright, it requires the binary to be launched through `santactl sandbox` (abbreviated…
- [Time Based Rules](https://northpole.security/docs/workshop/rules/time-based-rules.md): A time based rule is an execution rule whose policy is **CEL** and whose expression calls `policy_for_range()`.
- [Filter Expressions](https://northpole.security/docs/workshop/telemetry/filter-expressions.md): Telemetry filter expressions are CEL expressions evaluated by Santa on the client before events are uploaded.
- [Schema](https://northpole.security/docs/workshop/telemetry/schema.md): Workshop documents the telemetry schema per platform, because Santa describes each operating system in its own terms.
- [macOS Telemetry Schema](https://northpole.security/docs/workshop/telemetry/schema/macos.md): {/* Code generated from the telemetry schema by github.com/northpolesec/sleigh/cmd/schemadoc. DO NOT EDIT. */}

## Santa documentation

- [Intro](https://northpole.security/docs/santa/intro.md): Santa is a high-performance open-source security agent for macOS that provides
- [Known limitations](https://northpole.security/docs/santa/limitations.md): Santa only blocks execution (execve and variants); it doesn’t protect against
- [Keys](https://northpole.security/docs/santa/configuration/keys.md): This page describes all of the available configuration options recognized by
- [File-Access Authorization](https://northpole.security/docs/santa/configuration/faa.md): File Access Authorization (FAA) policies are defined using a plist configuration
- [Config Generator](https://northpole.security/docs/santa/configuration/generator.md): This generator is still under active development and there are known rough
- [Custom Branding](https://northpole.security/docs/santa/configuration/branding.md): Santa can display your organization's name or logo on every window it shows, so that users can tell who manages the machine and who to contact.
- [Common Expression Language (CEL)](https://northpole.security/docs/santa/cookbook/cel.md): This page lists well-known and/or community-contributed CEL expressions.
- [File-Access Authorization](https://northpole.security/docs/santa/cookbook/faa.md): This page lists well-known and/or community-contributed file-access
- [Transitive Allowlisting](https://northpole.security/docs/santa/cookbook/transitive.md): This page lists well-known and/or community-contributed Transitive Allowlisting
- [Getting Started](https://northpole.security/docs/santa/deployment/getting-started.md): Due to the security features built-in to macOS, deployment of Santa requires
- [Profiles: System Extension](https://northpole.security/docs/santa/deployment/profile-system-extension.md): One of the primary components of Santa is a [system
- [Profiles: Network Extension](https://northpole.security/docs/santa/deployment/profile-network-extension.md): Santa includes an optional network [system
- [Profiles: TCC](https://northpole.security/docs/santa/deployment/profile-tcc.md): macOS requires apps like Santa have "Full Disk Access" permissions in order to
- [Profiles: Background Apps](https://northpole.security/docs/santa/deployment/profile-background.md): Santa has components that run in the background (e.g. for presenting
- [Profiles: Notifications](https://northpole.security/docs/santa/deployment/profile-notifications.md): Santa can present native macOS notifications to users when it switches between
- [Profiles: Santa Configuration](https://northpole.security/docs/santa/deployment/profile-configuration.md): Santa has _many_ configuration options controlling its behavior. The
- [Install Santa Package](https://northpole.security/docs/santa/deployment/install-package.md): With all of the profiles configured you are finally ready to install the Santa
- [Network Extension](https://northpole.security/docs/santa/deployment/network-extension.md): Santa includes an optional network [system
- [Migration](https://northpole.security/docs/santa/deployment/migration.md): This guide outlines the migration process from Google Santa to North Pole
- [Lite Package](https://northpole.security/docs/santa/deployment/lite-package.md): Alongside the regular Santa deployment package, we also make available a "lite"
- [Troubleshooting](https://northpole.security/docs/santa/deployment/troubleshooting.md): This page outlines common troubleshooting steps for confirming proper Santa
- [Contributing](https://northpole.security/docs/santa/development/contributing.md): Before we can use your code, you must sign the [North Pole Security Individual
- [Building](https://northpole.security/docs/santa/development/building.md): Santa uses Bazel for building, testing, and releaseing.
- [Version Support Policies](https://northpole.security/docs/santa/development/version_policy.md): This document describes North Pole Security's policies on versioning as it
- [Binary Authorization](https://northpole.security/docs/santa/features/binary-authorization.md): Binary authorization, also known as binary allowlisting (and formerly, binary
- [Time Based Rules](https://northpole.security/docs/santa/features/time-based-rules.md): A time based rule is a CEL rule whose
- [File-Access Authorization](https://northpole.security/docs/santa/features/faa.md): File Access Authorization is a feature that lets Santa control which processes
- [Telemetry](https://northpole.security/docs/santa/features/telemetry.md): Santa collects and outputs telemetry data about security events. This data is
- [Removable Media (e.g. USB/SD device) Blocking](https://northpole.security/docs/santa/features/removable-media-blocking.md): Removable Media blocking allows blocking removable media such as USB Mass Storage/SD Card storage from mounting, or
- [Sync Servers](https://northpole.security/docs/santa/features/sync.md): Santa can be configured to synchronize with a central server, to control the

## Blog

- [Announcing Santa and Workshop 2026.8](https://northpole.security/blog/release-20268.md): Santa and Workshop 2026.8 add time based rules, a top-level Tags section, file access process overrides, sequence signals, and Nix package rules
- [Announcing Santa and Workshop 2026.7](https://northpole.security/blog/release-20267.md): Santa and Workshop 2026.7 add rule packs for every rule type, richer Signals, package inventory scanning, redesigned Commands, and more
- [Announcing Santa & Workshop 2026.6](https://northpole.security/blog/release-20266.md): Santa and Workshop 2026.6 add network rules, privilege management, Signals, webhooks, a redesigned Ready for Lockdown report, and more
- [EDR Freeze on macOS](https://northpole.security/blog/edr-freeze.md): EDR Freeze came to Windows via debugging tricks. macOS has its own version using pid_suspend, and one subscription call stops it
- [Announcing Santa 2026.5](https://northpole.security/blog/santa-20265.md): Santa 2026.5 adds sandbox profile rules, on-demand binary upload, CEL audit policies, and CEL fallback coverage for platform binaries.
- [Announcing Workshop 2026.5](https://northpole.security/blog/workshop-20265.md): Workshop v2026.5 introduces Seatbelt Rules in beta, multiparty approval on any method, a redesigned filter bar, and much more!
- [Announcing Santa 2026.4](https://northpole.security/blog/santa-20264.md): Santa 2026.4 expands tamper resistance, changes clean sync semantics, adds silenceable device notifications, and continues security hardening.
- [Announcing Workshop 2026.3](https://northpole.security/blog/workshop-20263.md): Workshop v2026.3 introduces CEL fallback rules, risk engine plugin filters, Santa host metrics, and much more!
- [Announcing Santa 2026.3](https://northpole.security/blog/santa-20263.md): Santa 2026.3 adds encryption-aware removable media policies, CEL fallback rules for global enforcement, and significant performance improvements.
- [Introducing AI Chat for Workshop](https://northpole.security/blog/introducing-ai-chat-for-workshop.md): Workshop now ships an AI chat that answers natural-language questions about hosts, rules, events, and policies. Bring your own LLM API key.
- [Blocking OpenClaw](https://northpole.security/blog/blocking-openclaw.md): OpenClaw (formerly Clawdbot and Moltbot) is an autonomous AI agent for macOS. Here's how to block every version with layered Santa CEL rules.
- [Telemetry, Rebuilt](https://northpole.security/blog/telemetry-rebuilt.md): Export Santa’s incredible telemetry stream to Workshop and query it directly from the Workshop UI using regular SQL.
- [Announcing Workshop 2026.2](https://northpole.security/blog/workshop-20262.md): Workshop v2026.2 introduces Chat with Workshop, Ancestor-based CEL policies, improved Telemetry export & querying, and much more!
- [Announcing Santa 2026.2](https://northpole.security/blog/santa-20262.md): Santa 2026.2 adds process-tree-aware CEL rules, network monitoring and statistics, telemetry export filters, and several quality improvements.
- [Announcing Touch ID for Santa](https://northpole.security/blog/touchid-biometric-authorization.md): Santa now supports Touch ID verification before execution, so CEL rules can require a biometric check for sensitive operations like remote debugging.
- [Announcing Santa 2026.1](https://northpole.security/blog/santa-20261.md): Santa 2026.1 adds TouchID-gated execution, network mount blocking, a menu bar item for common tasks, co-branding, and many other improvements.
- [Announcing Workshop 2026.1](https://northpole.security/blog/workshop-20261.md): Workshop 2026.1 adds Package Rules, TouchID-gated execution, network mount blocking, and a range of usability and performance improvements.
- [Introducing Package Rules](https://northpole.security/blog/introducing-package-rules.md): Workshop's new Package Rules automate allowlist maintenance for Homebrew, npm, Cargo, and other package managers so developers never get blocked.
- [Advent Calendar: 25 Days of macOS Protection](https://northpole.security/blog/2025-advent-calendar.md): Santa Security Advent Calendar: 25 production-ready CEL and FAA rules inspired by real macOS malware like Atomic Stealer, one new rule each day.
- [A Private Sync Protocol for Workshop](https://northpole.security/blog/private-sync-protocol-for-workshop.md): A new, private sync protocol has been introduced for Workshop customers that allows for faster feature delivery and iteration.
- [One Year of North Pole Security](https://northpole.security/blog/one-year-of-north-pole-security.md): Join us as we reflect on North Pole Security's first year, highlighting our achievements, challenges, and the dedicated team behind our success.
- [We Raised $4M to Reimagine Endpoint Security](https://northpole.security/blog/north-pole-security-raises-4m-from-andreessen-horowitz.md): North Pole Security closes a $4M seed round led by Andreessen Horowitz to accelerate Workshop, our prevention-first endpoint platform for macOS.