You signed up. Now what.

Start at /sign-in. Use the same email or social login you used when you created the account. After a successful sign-in, ORBIT sends you to the dashboard or the next unfinished onboarding step.

If you already finished setup but get sent back to it, do not create a second account and do not paste an API key into chat. Open /onboarding/setup-status and use the Step 5 recovery checklist. It verifies the hook and the first test escalation without exposing secrets.

Your account is provisioned with the Guardian default policy: 50 rules across 14 categories of risky agent behavior, each set to a sensible default (Allow, Ask me first, or Block). You did not have to write a policy to be governed. You can change every verdict, and you can add custom rules later.

You also have an API key. ORBIT uses it to identify your account when your agent calls in. The key is shown once. We will get to it in step 2.

When Guardian pauses an action and asks for your call, ORBIT sends you an alert. Without at least one alert channel you will miss those requests: a paused agent will time out and the action will be blocked, every time. Turning on alerts is the first thing worth doing.

Browser alerts are the simplest channel — free, unlimited, and no phone needed. Open /settings/notifications on the device you want alerted and turn them on.

Browser notifications are the delivery channel today: enable them on each device you want alerted. An unattended request times out and denies, so it is never silently allowed.

Open /keys. If a fresh key was created during signup, it is shown once at the top of the page. Copy it and stash it somewhere safe (a password manager is fine). If no plaintext key is visible, create a new key from the same page and copy that one-time value instead.

If you missed the one-time reveal, that key is gone. There is no plaintext recovery path by design. Issue a new key, update the hook environment or keychain entry, and revoke the old key only after orbit-hook whoami succeeds with the new key prefix.

Use the manual install guide for the current public path. It shows the binary install, API key setup, Claude Code hook wiring, and self-test without hiding the trust boundary behind a one-line installer.

If you are in an approved onboarding flow with a separate installer packet, inspect and verify that packet before running it.

You are helping me install Guardian for ORBIT. Read /docs/quickstart and /docs/install/manual first. Do not expose secrets. Do not change DNS, IAM, paid infrastructure, production services, or destructive data without asking me. Return the exact commands you ran, where the API key is stored, and the proof from orbit-hook whoami and the first dashboard action.

Open Claude Code in a project directory and ask it to do something benign. Anything will do; the goal is just to confirm the hook is firing and ORBIT sees the action.

A first call worth trying:

> List the files in this directory.

Claude runs ls. ORBIT records it. The Allow rule for read-only filesystem operations is the default, so no escalation fires and you do not get an approval alert.

Open the dashboard. Within a few seconds the action you just made shows up under recent activity, with the agent identity, the action, and the verdict ORBIT applied.

That is the loop: your agent proposes an action, ORBIT evaluates what the installed adapter can see, the dashboard records the verdict, and Guardian asks you only when your policy says to ask.

To trigger an escalation on purpose, ask Claude to run something the default policy treats as Ask me first. A safe option: ask it to run sudo for any reason. If your policy is still set to ask on sudo, ORBIT should pause the governed hook path and send you an alert before the command proceeds.

From here the product is yours to shape. The pieces worth knowing about:

• Rules is where you decide. Every rule is in there, with three verdicts (Allow, Ask me first, Block), plus plain-language rule proposals drawn from what your agents actually do. Change anything you want.
• Approvals is where you see what Guardian is currently asking you and what time-bounded approvals you have granted (10 minutes, 30 minutes, 1 hour).
• Audit is the full record of governed actions, searchable, with a downloadable receipt per action.
• Verify a receipt lets anyone (you or someone you hand a.orbitproof file to) confirm a receipt is authentic and untampered, without needing to trust ORBIT.

Common first-day friction:

• Sign-in works, but setup loops back to Step 5. Use the Step 5 recovery checklist. It is built for completed users whose hook or first escalation proof did not reach the setup status page yet.
• No approval alert arriving. Confirm browser alerts are enabled at /settings/notifications on the device you are watching, and that browser notifications are enabled at /settings/notifications. Approvals are always available in your signed-in ORBIT browser session.
• Claude Code is running but nothing lands in the dashboard. The hook might not be wired in. Run orbit-hook whoami in a terminal; it should print your account. If it prints an error, the API key is not where the hook expects it.
• An action you expected to be blocked was allowed. The Guardian default set is conservative-but-not-paranoid. Check the rule for that action in Rules; if its verdict is Allow, that is by design. Change it to Ask me first or Block and the next call follows the new rule.

Anything else, email support@orbitauthority.com. Reply latency is human-fast at launch volume.