Assign Policies to Teams with Groups
Groups connect people to policies: match on Active Directory groups, departments, email domains, hostnames, or manual pins — first match wins, and a Default Group catches everyone else.
A group connects people to a policy. Each group carries exactly one policy and a set of membership matchers that decide who belongs to it. When someone uses an AI tool, ZeusLock works out which group they fall into and applies that group's policy — so Finance, HR, and Engineering can each work under different rules without anyone configuring individual machines.
Groups live on the Policies page, Groups tab. Only owners and admins can manage them. If you have not created a policy yet, start with Create & Manage Policies.
Creating a group
Click New group and set:
- Name and an optional description.
- Assigned policy — the policy everyone in this group gets.
- Priority — the group's position in the matching order (lower numbers are checked first).
- Membership matchers — one or more of the rules below.
The membership matchers
| Matcher | Matches when… |
|---|---|
| Directory group | The user belongs to an Active Directory / Entra ID group. ZeusLock discovers your directory groups automatically from agent traffic — you pick from a dropdown, and can also match by name with * wildcards. |
| Directory attribute | A directory attribute has a value, e.g. department equals Finance. |
| Email domain | The person's sign-in email ends with a domain, e.g. @contractor.example.com — handy for contractors and subsidiaries. |
| Hostname pattern | The machine name matches a pattern, e.g. ^LT-FIN- for Finance laptops. |
| Override key | IT stamped a ZeusLock group key on the machine (a registry value on Windows, a configuration profile on macOS, a config file on Linux) — an explicit assignment that works with any management tooling. |
| Pin a person | You pin a specific person to the group by hand. |
| Pin a device | You pin a specific device to the group by hand. |
How matching works
- Within a group, matchers are ORed — any one of them puts a person in the group.
- Groups are evaluated in priority order, and the first match wins. Policies never merge: one person, one group, one policy.
- The built-in Default Group always comes last, has no matchers, and cannot be deleted — anyone no other group claims lands there and gets the Default Policy. Nobody is ever unprotected.
No Active Directory? No problem
Directory matchers are just one option. Email domain, hostname pattern, override key, and manual pins work on standalone Windows machines, macOS, and Linux — you can run team-level policies without any domain at all.
Check who gets what
The People tab lists every person ZeusLock has seen, with the group and policy they currently resolve to — and which matcher put them there. Use it to verify a rollout before tightening a policy, and to spot people landing in the Default Group that you expected elsewhere.
How changes reach endpoints
The desktop agent fetches its person-specific policy when it starts and keeps it fresh on its regular heartbeat — a policy or group change reaches endpoints within about 10 minutes, with no reinstall and no restart. The browser extension follows the same person's policy automatically (matched through their signed-in email). If nothing matches, the Default Policy applies.
Every incident records the policy, policy version, and group that were in force — so the incident history always shows which rules produced each event.