How Lucien Fits in Your Network

Lucien is an inline security appliance. It is placed in the network path between your endpoints and your gateway so that the traffic you want inspected flows through it on the way out. It is not a passive sensor on a span port and not a cloud service: it is a box in the line.

Where it sits

The path is Computer → Lucien → Gateway → Internet. Endpoints send outbound traffic through Lucien first. Lucien sits just ahead of the network gateway (the router/firewall that forwards traffic to the internet), so every connection it is meant to watch passes through it before reaching the gateway.

What it does to traffic: intercept vs. bypass

Lucien does not decrypt everything. It keeps an explicit list of domains to inspect, managed on the TLS Interception page. For each outbound connection:

• Selected domains are intercepted. If the destination is on your list (e.g. claude.ai, chatgpt.com, gemini.google.com, grok.com), Lucien terminates TLS using its own certificate authority, reads the prompt, sends it to the scoring engine, applies your policy (score, and optionally block), then re-encrypts and forwards the request to the gateway and on to the provider.
• Everything else is bypassed. Any destination not on the list is tunnelled straight through, untouched. Banking, email, software updates and any non-AI traffic are never opened.

The inspection surface is deliberately narrow and entirely under your control. Adding a domain opts it in; anything you do not add is left alone.

Why in-line placement matters

Because Lucien is in the path rather than beside it, it can enforce: when Block on violation is on, a request that scores as a BLOCK is dropped before it ever reaches the model. A passive tap could only observe and alert after the fact. The trade-off is that the appliance's availability is part of the traffic path: a network-design consideration covered in the installation manual.

Trust requirement. Because Lucien presents its own certificate for intercepted domains, client machines must trust Lucien's CA for interception to be seamless. The certificate is distributed from the TLS Interception page (Download certificate). Bypassed traffic needs no such trust, since it is never decrypted.