diff --git a/.gitattributes b/.gitattributes
index 3eb52bd81..6e1660656 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -1,3 +1,5 @@
+/.gitattributes text eol=lf
+
 *.rs text eol=lf
 *.toml text eol=lf
 *.cs text eol=lf
@@ -6,6 +8,7 @@
 *.sln text eol=crlf
 *.md text eol=lf
 *.mustache text eol=lf
+*.yml text eol=lf
 *.yaml text eol=lf
 
 devolutions-gateway/openapi/doc/index.adoc linguist-generated merge=binary
@@ -14,3 +17,6 @@ devolutions-gateway/openapi/dotnet-client/docs/** linguist-generated merge=binar
 devolutions-gateway/openapi/dotnet-subscriber/src/** linguist-generated merge=binary
 devolutions-gateway/openapi/ts-angular-client/api/** linguist-generated merge=binary
 devolutions-gateway/openapi/ts-angular-client/model/** linguist-generated merge=binary
+
+# Sample assets produce huge LoC counts; exclude them from language statistics.
+devolutions-agent/src/broker/assets/** linguist-generated
diff --git a/Cargo.lock b/Cargo.lock
index 560224325..9a3a1e894 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1185,6 +1185,15 @@ version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2f421161cb492475f1661ddc9815a745a1c894592070661180fdec3d4872e9c3"
 
+[[package]]
+name = "convert_case"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "633458d4ef8c78b72454de2d54fd6ab2e60f9e02be22f3c6104cdc8a4e0fceb9"
+dependencies = [
+ "unicode-segmentation",
+]
+
 [[package]]
 name = "core-foundation"
 version = "0.9.4"
@@ -1576,6 +1585,29 @@ dependencies = [
  "syn 1.0.109",
 ]
 
+[[package]]
+name = "derive_more"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d751e9e49156b02b44f9c1815bcb94b984cdcc4396ecc32521c739452808b134"
+dependencies = [
+ "derive_more-impl",
+]
+
+[[package]]
+name = "derive_more-impl"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "799a97264921d8623a957f6c3b9011f3b5492f557bbb7a5a19b7fa6d06ba8dcb"
+dependencies = [
+ "convert_case",
+ "proc-macro2 1.0.106",
+ "quote 1.0.45",
+ "rustc_version",
+ "syn 2.0.117",
+ "unicode-xid 0.2.6",
+]
+
 [[package]]
 name = "des"
 version = "0.9.0-rc.1"
@@ -1593,11 +1625,13 @@ dependencies = [
  "anyhow",
  "async-trait",
  "aws-lc-rs",
+ "axum 0.8.9",
  "backoff",
  "base64 0.22.1",
  "bytes 1.11.1",
  "camino",
  "ceviche",
+ "chrono",
  "ctrlc",
  "devolutions-agent-shared",
  "devolutions-gateway-task",
@@ -1609,9 +1643,15 @@ dependencies = [
  "hex",
  "hostname 0.4.2",
  "http-client-proxy",
+ "hyper 1.9.0",
+ "hyper-util",
  "ipnetwork",
  "ironrdp",
+ "notify 7.0.0",
  "notify-debouncer-mini",
+ "now-policy",
+ "now-policy-api",
+ "now-policy-server-template",
  "parking_lot",
  "prost 0.13.5",
  "prost-types",
@@ -1619,12 +1659,14 @@ dependencies = [
  "quinn",
  "rand 0.8.6",
  "rcgen",
+ "regex",
  "reqwest",
  "rustls 0.23.41",
  "rustls-pemfile 2.2.0",
  "rustls-pki-types",
  "serde",
  "serde_json",
+ "serde_yaml",
  "sha2 0.10.9",
  "tap",
  "tempfile",
@@ -1636,6 +1678,7 @@ dependencies = [
  "tokio-tungstenite 0.26.2",
  "tonic 0.12.3",
  "tonic-build",
+ "tower-service",
  "tracing",
  "url",
  "uuid",
@@ -2303,6 +2346,16 @@ version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "64cd1e32ddd350061ae6edb1b082d7c54915b5c672c389143b9a63403a109f24"
 
+[[package]]
+name = "filetime"
+version = "0.2.29"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c287a33c7f0a620c38e641e7f60827713987b3c0f26e8ddc9462cc69cf75759"
+dependencies = [
+ "cfg-if",
+ "libc",
+]
+
 [[package]]
 name = "find-msvc-tools"
 version = "0.1.9"
@@ -3277,6 +3330,17 @@ dependencies = [
  "serde_core",
 ]
 
+[[package]]
+name = "inotify"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fdd168d97690d0b8c412d6b6c10360277f4d7ee495c5d0d5d5fe0854923255cc"
+dependencies = [
+ "bitflags 1.3.2",
+ "inotify-sys",
+ "libc",
+]
+
 [[package]]
 name = "inotify"
 version = "0.11.1"
@@ -4631,6 +4695,24 @@ version = "0.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9737e026353e5cd0736f98eddae28665118eb6f6600902a7f50db585621fecb6"
 
+[[package]]
+name = "notify"
+version = "7.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c533b4c39709f9ba5005d8002048266593c1cfaf3c5f0739d5b8ab0c6c504009"
+dependencies = [
+ "bitflags 2.11.1",
+ "filetime",
+ "inotify 0.10.2",
+ "kqueue",
+ "libc",
+ "log",
+ "mio",
+ "notify-types 1.0.1",
+ "walkdir",
+ "windows-sys 0.52.0",
+]
+
 [[package]]
 name = "notify"
 version = "8.2.0"
@@ -4639,12 +4721,12 @@ checksum = "4d3d07927151ff8575b7087f245456e549fea62edf0ec4e565a5ee50c8402bc3"
 dependencies = [
  "bitflags 2.11.1",
  "fsevent-sys",
- "inotify",
+ "inotify 0.11.1",
  "kqueue",
  "libc",
  "log",
  "mio",
- "notify-types",
+ "notify-types 2.1.0",
  "walkdir",
  "windows-sys 0.60.2",
 ]
@@ -4656,11 +4738,20 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a689eb4262184d9a1727f9087cd03883ea716682ab03ed24efec57d7716dccb8"
 dependencies = [
  "log",
- "notify",
- "notify-types",
+ "notify 8.2.0",
+ "notify-types 2.1.0",
  "tempfile",
 ]
 
+[[package]]
+name = "notify-types"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "585d3cb5e12e01aed9e8a1f70d5c6b5e86fe2a6e48fc8cd0b3e0b8df6f6eb174"
+dependencies = [
+ "instant",
+]
+
 [[package]]
 name = "notify-types"
 version = "2.1.0"
@@ -4670,6 +4761,57 @@ dependencies = [
  "bitflags 2.11.1",
 ]
 
+[[package]]
+name = "now-policy"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d87d7ba63d8fcbbae125f975c5e30a54ed4507027dd70d6daa0aa63003cac2e"
+dependencies = [
+ "chrono",
+ "schemars",
+ "semver",
+ "serde",
+ "serde_json",
+ "serde_yaml",
+ "thiserror 2.0.18",
+ "url",
+]
+
+[[package]]
+name = "now-policy-api"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b3837290f7ed48038a8ca4d9dfb98a0c44a5debe141cdd7d740d59eca4df4fa5"
+dependencies = [
+ "base64 0.22.1",
+ "chrono",
+ "derive_more",
+ "now-policy",
+ "schemars",
+ "semver",
+ "serde",
+ "serde_json",
+ "strum",
+ "thiserror 2.0.18",
+]
+
+[[package]]
+name = "now-policy-server-template"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92afa468bf18b66af5d209caac39fcff241b07495c538d032221736e8a7f95c6"
+dependencies = [
+ "aide",
+ "async-trait",
+ "axum 0.8.9",
+ "now-policy",
+ "now-policy-api",
+ "schemars",
+ "serde",
+ "serde_json",
+ "serde_yaml",
+]
+
 [[package]]
 name = "now-proto-pdu"
 version = "0.4.3"
@@ -7098,6 +7240,27 @@ dependencies = [
  "unicode-properties",
 ]
 
+[[package]]
+name = "strum"
+version = "0.27.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "af23d6f6c1a224baef9d3f61e287d2761385a5b88fdab4eb4c6f11aeb54c4bcf"
+dependencies = [
+ "strum_macros",
+]
+
+[[package]]
+name = "strum_macros"
+version = "0.27.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7695ce3845ea4b33927c055a39dc438a45b059f7c1b3d91d38d10355fb8cbca7"
+dependencies = [
+ "heck",
+ "proc-macro2 1.0.106",
+ "quote 1.0.45",
+ "syn 2.0.117",
+]
+
 [[package]]
 name = "subtle"
 version = "2.6.1"
@@ -8272,6 +8435,12 @@ version = "0.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7df058c713841ad818f1dc5d3fd88063241cc61f49f5fbea4b951e8cf5a8d71d"
 
+[[package]]
+name = "unicode-segmentation"
+version = "1.13.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6f5d3c3b1bf09027a88a6bc961fc00497d651009560b5463668dc81b0fa87a8"
+
 [[package]]
 name = "unicode-xid"
 version = "0.1.0"
diff --git a/devolutions-agent/Cargo.toml b/devolutions-agent/Cargo.toml
index 3e19a8017..50f87dc0d 100644
--- a/devolutions-agent/Cargo.toml
+++ b/devolutions-agent/Cargo.toml
@@ -16,10 +16,12 @@ agent-tunnel-proto = { path = "../crates/agent-tunnel-proto" }
 anyhow = "1"
 backoff = "0.4"
 async-trait = "0.1"
+axum = { version = "0.8", default-features = false, features = ["http1", "json", "tokio", "original-uri", "matched-path"] }
 base64 = "0.22"
 bytes = "1"
 camino = { version = "1.1", features = ["serde1"] }
 ceviche = "0.7"
+chrono = { version = "0.4", features = ["serde"] }
 ctrlc = "3.5"
 devolutions-agent-shared = { path = "../crates/devolutions-agent-shared" }
 devolutions-gateway-task = { path = "../crates/devolutions-gateway-task" }
@@ -27,14 +29,21 @@ devolutions-log = { path = "../crates/devolutions-log" }
 futures = "0.3"
 hex = "0.4"
 hostname = "0.4"
+hyper = { version = "1", features = ["http1", "server"] }
+hyper-util = { version = "0.1", features = ["tokio", "server", "server-auto", "service"] }
 http-client-proxy = { path = "../crates/http-client-proxy" }
 ipnetwork = "0.20"
+notify = { version = "7", default-features = false, features = ["macos_kqueue"] }
+now-policy = "0.1"
+now-policy-api = { version = "0.1", features = ["policy-compat"] }
+now-policy-server-template = { version = "0.1", features = ["policy-compat"] }
 parking_lot = "0.12"
 prost = "0.13"
 prost-types = "0.13"
 quinn = "0.11"
 rand = "0.8" # FIXME(@CBenoit): maybe we don't need this crate
 rcgen = { version = "0.13", features = ["pem"] }
+regex = "1"
 reqwest = { version = "0.12", default-features = false, features = ["rustls-tls-native-roots", "http2", "socks", "json"] }
 rustls = { version = "0.23", default-features = false, features = ["std", "ring"] }
 rustls-pemfile = "2.2"
@@ -42,12 +51,14 @@ rustls-pki-types = "1"
 sha2 = "0.10"
 serde_json = "1"
 serde = { version = "1", features = ["derive"] }
+serde_yaml = "0.9"
 tap = "1.0"
 tempfile = "3"
 tokio-tungstenite = { version = "0.26", features = ["rustls-tls-native-roots"] }
 tokio-rustls = { version = "0.26", default-features = false, features = ["logging", "tls12", "ring"] }
 tokio-stream = "0.1"
 tonic = { version = "0.12", features = ["transport"] }
+tower-service = "0.3"
 tracing = "0.1"
 url = { version = "2.5", features = ["serde"] }
 x509-parser = "0.16"
@@ -74,6 +85,7 @@ features = [
     "fs",
     "process",
     "sync",
+    "time",
 ]
 
 [target.'cfg(windows)'.dependencies]
@@ -97,6 +109,7 @@ features = [
     "Win32_Security_Cryptography",
     "Win32_Security_Authorization",
     "Win32_System_ApplicationInstallationAndServicing",
+    "Win32_System_Pipes",
     "Win32_System_RemoteDesktop",
 ]
 
diff --git a/devolutions-agent/src/broker/assets/samples/corporate-allowlist.policy.json b/devolutions-agent/src/broker/assets/samples/corporate-allowlist.policy.json
new file mode 100644
index 000000000..55827e552
--- /dev/null
+++ b/devolutions-agent/src/broker/assets/samples/corporate-allowlist.policy.json
@@ -0,0 +1,134 @@
+{
+  "$schema": "https://devolutions.net/schemas/now-policy.schema.1.0.json",
+  "PolicyVersion": "1.0.0",
+  "PolicyType": "PackageBrokerPolicy",
+  "Metadata": {
+    "Id": "contoso.desktop.standard-allowlist",
+    "Publisher": "Contoso IT",
+    "Revision": 4,
+    "PublishedAt": "2026-05-05T00:00:00Z",
+    "Description": "Fail-closed policy for standard workstation package installs."
+  },
+  "Enforcement": {
+    "DefaultDecision": "Deny",
+    "RulePrecedence": "PriorityThenDeny"
+  },
+  "Rules": [
+    {
+      "Id": "deny.integrity-bypass",
+      "Enabled": true,
+      "Priority": 10,
+      "Decision": "Deny",
+      "Reason": "Integrity and publisher checks cannot be bypassed by brokered requests.",
+      "Match": {
+        "Operations": [
+          "Install",
+          "Update"
+        ],
+        "SkipHashCheck": [
+          true
+        ]
+      }
+    },
+    {
+      "Id": "deny.custom-parameters",
+      "Enabled": true,
+      "Priority": 20,
+      "Decision": "Deny",
+      "Reason": "Custom package-manager parameters are not allowed in the workstation allow list.",
+      "Match": {
+        "HasCustomParameters": [
+          true
+        ]
+      }
+    },
+    {
+      "Id": "deny.prepost-commands",
+      "Enabled": true,
+      "Priority": 30,
+      "Decision": "Deny",
+      "Reason": "Pre and post operation commands are not allowed in the workstation allow list.",
+      "Match": {
+        "HasPrePostCommands": [
+          true
+        ]
+      }
+    },
+    {
+      "Id": "allow.winget.vscode",
+      "Enabled": true,
+      "Priority": 100,
+      "Decision": "Allow",
+      "Reason": "Visual Studio Code is approved for managed workstations.",
+      "Match": {
+        "Operations": [
+          "Install",
+          "Update"
+        ],
+        "Managers": [
+          "Winget"
+        ],
+        "Sources": [
+          "winget"
+        ],
+        "PackageIdentifiers": [
+          "Microsoft.VisualStudioCode"
+        ],
+        "Scopes": [
+          "User",
+          "Machine"
+        ],
+        "Architectures": [
+          "X64",
+          "Arm64"
+        ]
+      },
+      "Constraints": {
+        "AllowInteractive": false,
+        "AllowSkipHashCheck": false,
+        "AllowPreRelease": false,
+        "AllowCustomParameters": false,
+        "AllowPrePostCommands": false,
+        "AllowKillBeforeOperation": false
+      }
+    },
+    {
+      "Id": "allow.winget.powertoys",
+      "Enabled": true,
+      "Priority": 100,
+      "Decision": "Allow",
+      "Reason": "PowerToys is approved for developer workstations.",
+      "Match": {
+        "Operations": [
+          "Install",
+          "Update"
+        ],
+        "Managers": [
+          "Winget"
+        ],
+        "Sources": [
+          "winget"
+        ],
+        "PackageIdentifiers": [
+          "Microsoft.PowerToys"
+        ],
+        "Scopes": [
+          "User",
+          "Machine"
+        ],
+        "Architectures": [
+          "X64",
+          "Arm64"
+        ]
+      },
+      "Constraints": {
+        "AllowInteractive": false,
+        "AllowSkipHashCheck": false,
+        "AllowPreRelease": false,
+        "AllowCustomParameters": false,
+        "AllowPrePostCommands": false,
+        "AllowKillBeforeOperation": false
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/devolutions-agent/src/broker/assets/samples/deny-risky-options.policy.json b/devolutions-agent/src/broker/assets/samples/deny-risky-options.policy.json
new file mode 100644
index 000000000..76197cb01
--- /dev/null
+++ b/devolutions-agent/src/broker/assets/samples/deny-risky-options.policy.json
@@ -0,0 +1,81 @@
+{
+  "$schema": "https://devolutions.net/schemas/now-policy.schema.1.0.json",
+  "PolicyVersion": "1.0.0",
+  "PolicyType": "PackageBrokerPolicy",
+  "Metadata": {
+    "Id": "contoso.desktop.deny-risky-options",
+    "Publisher": "Contoso IT",
+    "Revision": 2,
+    "PublishedAt": "2026-05-05T00:00:00Z",
+    "Description": "Default-allow policy that blocks risky broker request options."
+  },
+  "Enforcement": {
+    "DefaultDecision": "Allow",
+    "RulePrecedence": "PriorityThenDeny"
+  },
+  "Rules": [
+    {
+      "Id": "deny.integrity-bypass",
+      "Priority": 10,
+      "Decision": "Deny",
+      "Reason": "Do not broker installs that skip WinGet hash checks or PowerShell publisher checks.",
+      "Match": {
+        "Operations": [
+          "Install",
+          "Update"
+        ],
+        "SkipHashCheck": [
+          true
+        ]
+      }
+    },
+    {
+      "Id": "deny.manager-custom-parameters",
+      "Priority": 20,
+      "Decision": "Deny",
+      "Reason": "Custom package-manager parameters require a dedicated exception policy.",
+      "Match": {
+        "HasCustomParameters": [
+          true
+        ]
+      }
+    },
+    {
+      "Id": "deny.prepost-commands",
+      "Priority": 30,
+      "Decision": "Deny",
+      "Reason": "Pre and post operation commands are outside the package manager trust boundary.",
+      "Match": {
+        "HasPrePostCommands": [
+          true
+        ]
+      }
+    },
+    {
+      "Id": "deny.kill-process-actions",
+      "Priority": 40,
+      "Decision": "Deny",
+      "Reason": "Killing processes before a brokered package operation is not allowed by this policy.",
+      "Match": {
+        "HasKillBeforeOperation": [
+          true
+        ]
+      }
+    },
+    {
+      "Id": "deny.unapproved-winget-source",
+      "Priority": 50,
+      "Decision": "Deny",
+      "Reason": "Only the default WinGet source is accepted by this deny-list sample.",
+      "Match": {
+        "Managers": [
+          "Winget"
+        ],
+        "Sources": [
+          "msstore",
+          "winget-fonts"
+        ]
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/devolutions-agent/src/broker/assets/samples/requests/winget-unknown-install.request.json b/devolutions-agent/src/broker/assets/samples/requests/winget-unknown-install.request.json
new file mode 100644
index 000000000..5396eaa11
--- /dev/null
+++ b/devolutions-agent/src/broker/assets/samples/requests/winget-unknown-install.request.json
@@ -0,0 +1,31 @@
+{
+  "RequestKind": "PackageRequest",
+  "RequestVersion": "1.0",
+  "RequestId": "req-winget-unknown-install",
+  "CreatedAt": "2026-05-05T12:05:00Z",
+  "Operation": "Install",
+  "Manager": "Winget",
+  "Source": {
+    "Name": "winget",
+    "Url": "https://cdn.winget.microsoft.com/cache"
+  },
+  "Package": {
+    "Id": "Example.UnapprovedTool",
+    "Architecture": "X64"
+  },
+  "Options": {
+    "Scope": "User",
+    "Interactive": false,
+    "SkipHashCheck": false,
+    "PreRelease": false,
+    "CustomParameters": [],
+    "KillBeforeOperation": []
+  },
+  "Client": {
+    "RequestedElevation": "Standard",
+    "EffectiveUser": "CONTOSO\\alice",
+    "ClientVersion": "3.2.0",
+    "Transport": "HttpNamedPipe",
+    "ClientExecutablePath": "C:\\Program Files\\Devolutions\\NOW\\now-client.exe"
+  }
+}
diff --git a/devolutions-agent/src/broker/assets/samples/requests/winget-vscode-install.request.json b/devolutions-agent/src/broker/assets/samples/requests/winget-vscode-install.request.json
new file mode 100644
index 000000000..479ea486a
--- /dev/null
+++ b/devolutions-agent/src/broker/assets/samples/requests/winget-vscode-install.request.json
@@ -0,0 +1,32 @@
+{
+  "RequestKind": "PackageRequest",
+  "RequestVersion": "1.0",
+  "RequestId": "req-winget-vscode-install",
+  "CreatedAt": "2026-05-05T12:00:00Z",
+  "Operation": "Install",
+  "Manager": "Winget",
+  "Source": {
+    "Name": "winget",
+    "Url": "https://cdn.winget.microsoft.com/cache"
+  },
+  "Package": {
+    "Id": "Microsoft.VisualStudioCode",
+    "Architecture": "X64"
+  },
+  "Options": {
+    "Scope": "Machine",
+    "Interactive": false,
+    "SkipHashCheck": false,
+    "PreRelease": false,
+    "CustomParameters": [],
+    "KillBeforeOperation": []
+  },
+  "Client": {
+    "RequestedElevation": "Elevated",
+    "EffectiveUser": "CONTOSO\\alice",
+    "ClientVersion": "3.2.0",
+    "Transport": "HttpNamedPipe",
+    "ClientExecutablePath": "C:\\Program Files\\Devolutions\\NOW\\now-client.exe"
+  },
+  "IncludeCommandPreview": true
+}
diff --git a/devolutions-agent/src/broker/assets/samples/requests/winget-vscode-skiphash.request.json b/devolutions-agent/src/broker/assets/samples/requests/winget-vscode-skiphash.request.json
new file mode 100644
index 000000000..e180ad2cf
--- /dev/null
+++ b/devolutions-agent/src/broker/assets/samples/requests/winget-vscode-skiphash.request.json
@@ -0,0 +1,31 @@
+{
+  "RequestKind": "PackageRequest",
+  "RequestVersion": "1.0",
+  "RequestId": "req-winget-vscode-skiphash",
+  "CreatedAt": "2026-05-05T12:10:00Z",
+  "Operation": "Install",
+  "Manager": "Winget",
+  "Source": {
+    "Name": "winget",
+    "Url": "https://cdn.winget.microsoft.com/cache"
+  },
+  "Package": {
+    "Id": "Microsoft.VisualStudioCode",
+    "Architecture": "X64"
+  },
+  "Options": {
+    "Scope": "Machine",
+    "Interactive": false,
+    "SkipHashCheck": true,
+    "PreRelease": false,
+    "CustomParameters": [],
+    "KillBeforeOperation": []
+  },
+  "Client": {
+    "RequestedElevation": "Elevated",
+    "EffectiveUser": "CONTOSO\\alice",
+    "ClientVersion": "3.2.0",
+    "Transport": "HttpNamedPipe",
+    "ClientExecutablePath": "C:\\Program Files\\Devolutions\\NOW\\now-client.exe"
+  }
+}
diff --git a/devolutions-agent/src/broker/assets/samples/scenarios/baseline.scenarios.json b/devolutions-agent/src/broker/assets/samples/scenarios/baseline.scenarios.json
new file mode 100644
index 000000000..c8ba84719
--- /dev/null
+++ b/devolutions-agent/src/broker/assets/samples/scenarios/baseline.scenarios.json
@@ -0,0 +1,38 @@
+{
+  "ScenarioSet": "baseline",
+  "Description": "Broad end-to-end scenarios for the gateway-owned package broker policy flow.",
+  "Scenarios": [
+    {
+      "Id": "baseline.winget.vscode.allow",
+      "Policy": "corporate-allowlist.policy.json",
+      "Request": "requests/winget-vscode-install.request.json",
+      "ExpectedDecision": "Allow",
+      "ExpectedRuleId": "allow.winget.vscode",
+      "Tags": ["baseline", "winget", "allowlist"]
+    },
+    {
+      "Id": "baseline.winget.unknown.default-deny",
+      "Policy": "corporate-allowlist.policy.json",
+      "Request": "requests/winget-unknown-install.request.json",
+      "ExpectedDecision": "Deny",
+      "ExpectedRuleId": "<default>",
+      "Tags": ["baseline", "winget", "default-deny"]
+    },
+    {
+      "Id": "baseline.winget.skiphash.deny",
+      "Policy": "corporate-allowlist.policy.json",
+      "Request": "requests/winget-vscode-skiphash.request.json",
+      "ExpectedDecision": "Deny",
+      "ExpectedRuleId": "deny.integrity-bypass",
+      "Tags": ["baseline", "winget", "risky-options"]
+    },
+    {
+      "Id": "baseline.default-allow.normal-install",
+      "Policy": "deny-risky-options.policy.json",
+      "Request": "requests/winget-vscode-install.request.json",
+      "ExpectedDecision": "Allow",
+      "ExpectedRuleId": "<default>",
+      "Tags": ["baseline", "winget", "default-allow"]
+    }
+  ]
+}
\ No newline at end of file
diff --git a/devolutions-agent/src/broker/auth.rs b/devolutions-agent/src/broker/auth.rs
new file mode 100644
index 000000000..23edf95b1
--- /dev/null
+++ b/devolutions-agent/src/broker/auth.rs
@@ -0,0 +1,184 @@
+//! Package broker pipe client authentication.
+
+use std::path::{Path, PathBuf};
+
+use anyhow::{Context as _, bail};
+use now_policy_api::PackageRequest;
+use tokio::net::windows::named_pipe::NamedPipeServer;
+use win_api_wrappers::process::Process;
+use windows::Win32::Security::TOKEN_QUERY;
+use windows::Win32::System::Threading::PROCESS_QUERY_LIMITED_INFORMATION;
+
+use crate::code_signing::validate_devolutions_authenticode_signature;
+
+#[derive(Clone, Debug)]
+pub(crate) struct PipeClient {
+    process_id: u32,
+    executable_path: PathBuf,
+    user: ClientUser,
+}
+
+#[derive(Clone, Debug)]
+struct ClientUser {
+    domain: String,
+    name: String,
+}
+
+impl PipeClient {
+    pub(crate) fn from_connected_pipe(server: &NamedPipeServer) -> anyhow::Result<Self> {
+        let process_id = connected_pipe_client_process_id(server).context("failed to query pipe client process id")?;
+        let process = Process::get_by_pid(process_id, PROCESS_QUERY_LIMITED_INFORMATION)
+            .with_context(|| format!("failed to open pipe client process {process_id}"))?;
+        let executable_path = process
+            .exe_path()
+            .with_context(|| format!("failed to query pipe client process {process_id} executable path"))?;
+        let sid = process
+            .token(TOKEN_QUERY)
+            .with_context(|| format!("failed to open pipe client process {process_id} token"))?
+            .sid_and_attributes()
+            .with_context(|| format!("failed to query pipe client process {process_id} token user"))?
+            .sid;
+        let account = sid
+            .lookup_account(None)
+            .with_context(|| format!("failed to resolve pipe client process {process_id} user"))?;
+        let user = ClientUser {
+            domain: account.domain_name.to_string_lossy(),
+            name: account.name.to_string_lossy(),
+        };
+
+        Ok(Self {
+            process_id,
+            executable_path,
+            user,
+        })
+    }
+
+    pub(crate) fn validate_request(
+        &self,
+        request: &PackageRequest,
+        skip_signature_validation: bool,
+    ) -> anyhow::Result<()> {
+        self.validate_effective_user(&request.client.effective_user)?;
+        self.validate_executable_path(&request.client.client_executable_path)?;
+
+        if skip_signature_validation {
+            tracing::warn!("DEBUG MODE: Skipping package broker client signature validation");
+            return Ok(());
+        }
+
+        let thumbprint = validate_devolutions_authenticode_signature(&self.executable_path)?;
+
+        tracing::debug!(
+            process_id = self.process_id,
+            executable = %self.executable_path.display(),
+            certificate_thumbprint = %thumbprint,
+            "Package broker pipe client authenticated"
+        );
+
+        Ok(())
+    }
+
+    fn validate_effective_user(&self, effective_user: &str) -> anyhow::Result<()> {
+        if same_user(effective_user, &self.user) {
+            return Ok(());
+        }
+
+        bail!(
+            "pipe client user '{}\\{}' does not match request effective_user '{}'",
+            self.user.domain,
+            self.user.name,
+            effective_user
+        )
+    }
+
+    fn validate_executable_path(&self, requested_executable_path: &str) -> anyhow::Result<()> {
+        let requested_path = Path::new(requested_executable_path);
+        if !requested_path.is_absolute() {
+            bail!("request client executable path is not absolute");
+        }
+
+        let actual_path = canonicalize_for_comparison(&self.executable_path).with_context(|| {
+            format!(
+                "failed to canonicalize pipe client executable path '{}'",
+                self.executable_path.display()
+            )
+        })?;
+        let requested_path = canonicalize_for_comparison(requested_path).with_context(|| {
+            format!(
+                "failed to canonicalize request client executable path '{}'",
+                requested_executable_path
+            )
+        })?;
+
+        if same_windows_path(&actual_path, &requested_path) {
+            return Ok(());
+        }
+
+        bail!(
+            "pipe client executable '{}' does not match request client executable '{}'",
+            actual_path.display(),
+            requested_path.display()
+        )
+    }
+}
+
+fn connected_pipe_client_process_id(server: &NamedPipeServer) -> anyhow::Result<u32> {
+    use std::os::windows::io::AsRawHandle as _;
+
+    use windows::Win32::Foundation::HANDLE;
+    use windows::Win32::System::Pipes::GetNamedPipeClientProcessId;
+
+    let mut process_id = 0u32;
+    let handle = HANDLE(server.as_raw_handle());
+
+    // SAFETY: `server` is a connected named-pipe server instance and the process id
+    // output pointer is valid for the duration of the call.
+    unsafe { GetNamedPipeClientProcessId(handle, &mut process_id) }?;
+
+    Ok(process_id)
+}
+
+fn same_user(expected: &str, actual: &ClientUser) -> bool {
+    let Some((expected_domain, expected_name)) = expected.rsplit_once('\\') else {
+        return expected.eq_ignore_ascii_case(&actual.name);
+    };
+
+    expected_domain.eq_ignore_ascii_case(&actual.domain) && expected_name.eq_ignore_ascii_case(&actual.name)
+}
+
+fn canonicalize_for_comparison(path: &Path) -> anyhow::Result<PathBuf> {
+    Ok(std::fs::canonicalize(path)?)
+}
+
+fn same_windows_path(left: &Path, right: &Path) -> bool {
+    left.as_os_str()
+        .to_string_lossy()
+        .eq_ignore_ascii_case(&right.as_os_str().to_string_lossy())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn client_user() -> ClientUser {
+        ClientUser {
+            domain: "CONTOSO".to_owned(),
+            name: "alice".to_owned(),
+        }
+    }
+
+    #[test]
+    fn same_user_matches_domain_qualified_user() {
+        assert!(same_user("contoso\\ALICE", &client_user()));
+    }
+
+    #[test]
+    fn same_user_matches_unqualified_user() {
+        assert!(same_user("ALICE", &client_user()));
+    }
+
+    #[test]
+    fn same_user_rejects_wrong_domain() {
+        assert!(!same_user("FABRIKAM\\alice", &client_user()));
+    }
+}
diff --git a/devolutions-agent/src/broker/command_builder/mod.rs b/devolutions-agent/src/broker/command_builder/mod.rs
new file mode 100644
index 000000000..f50bd0a00
--- /dev/null
+++ b/devolutions-agent/src/broker/command_builder/mod.rs
@@ -0,0 +1,38 @@
+//! Command-line builders for package manager operations.
+//!
+//! Constructs the commands the broker would execute from validated request fields.
+//! The broker never executes client-supplied commands directly.
+
+pub mod powershell;
+pub mod winget;
+
+use now_policy_api::{ManagerName, PackageRequest};
+
+/// Build a command line from a validated request, dispatching to the appropriate
+/// package manager builder.
+///
+/// Returns the command as a list of arguments (first element is the executable).
+pub fn build_command(request: &PackageRequest) -> Vec<String> {
+    match request.manager {
+        ManagerName::Winget => winget::build_winget_command(request),
+        ManagerName::PowerShell => powershell::build_powershell5_command(request),
+        ManagerName::PowerShell7 => powershell::build_powershell7_command(request),
+    }
+}
+
+/// Append `--flag value` to command if value is `Some` and non-empty.
+pub(crate) fn set_if_specified(command: &mut Vec<String>, flag: &str, value: Option<&str>) {
+    if let Some(v) = value
+        && !v.is_empty()
+    {
+        command.push(flag.to_owned());
+        command.push(v.to_owned());
+    }
+}
+
+/// Append `--flag` to command if value is true.
+pub(crate) fn set_if_true(command: &mut Vec<String>, flag: &str, value: bool) {
+    if value {
+        command.push(flag.to_owned());
+    }
+}
diff --git a/devolutions-agent/src/broker/command_builder/powershell.rs b/devolutions-agent/src/broker/command_builder/powershell.rs
new file mode 100644
index 000000000..8b0d313c5
--- /dev/null
+++ b/devolutions-agent/src/broker/command_builder/powershell.rs
@@ -0,0 +1,285 @@
+//! PowerShell command-line builders for WinPS 5.x and PowerShell 7.x.
+//!
+//! These mirror package broker client PowerShell manager helpers so the broker runs the
+//! same command the unelevated client would have run:
+//! - PowerShell 5 uses PowerShellGet (`Install-Module`/`Update-Module`/`Uninstall-Module`)
+//!   invoked as `powershell.exe -NoProfile -Command <script>`.
+//! - PowerShell 7 uses PSResourceGet (`Install-PSResource`/`Update-PSResource`/
+//!   `Uninstall-PSResource`) invoked as `pwsh.exe -NoProfile -Command <script>`.
+//!
+//! Neither builder pins a `-Repository`/source: the package source is
+//! part of the policy-matched request identity, but the executed command lets the
+//! PowerShell module resolver pick the repository. Options that don't apply to
+//! PowerShell modules (interactive, custom install location, winget's no-upgrade /
+//! uninstall-previous) are intentionally omitted.
+
+use now_policy_api::{Operation, PackageRequest, Scope};
+
+/// Build a Windows PowerShell 5.x (PowerShellGet) command from a validated request.
+pub fn build_powershell5_command(request: &PackageRequest) -> Vec<String> {
+    let mut script = String::new();
+
+    let verb = match request.operation {
+        Operation::Install => "Install-Module",
+        Operation::Update => "Update-Module",
+        Operation::Uninstall => "Uninstall-Module",
+    };
+
+    append_raw(&mut script, verb);
+    append_flag_value(&mut script, "-Name", &request.package.id.0);
+    append_raw(&mut script, "-Confirm:$false");
+    append_raw(&mut script, "-Force");
+
+    if !matches!(request.operation, Operation::Uninstall) {
+        if request.options.pre_release {
+            append_raw(&mut script, "-AllowPrerelease");
+        }
+
+        match request.options.scope {
+            Some(Scope::Machine) => append_raw(&mut script, "-Scope AllUsers"),
+            Some(Scope::User) | None => append_raw(&mut script, "-Scope CurrentUser"),
+        }
+    }
+
+    if matches!(request.operation, Operation::Install) {
+        if request.options.skip_hash_check {
+            append_raw(&mut script, "-SkipPublisherCheck");
+        }
+
+        if let Some(version) = request.package.version.as_deref() {
+            append_flag_value(&mut script, "-RequiredVersion", version);
+        }
+    }
+
+    for param in &request.options.custom_parameters {
+        if !param.is_empty() {
+            append_raw(&mut script, &param.0);
+        }
+    }
+
+    vec![
+        "powershell.exe".to_owned(),
+        "-NoProfile".to_owned(),
+        "-Command".to_owned(),
+        script,
+    ]
+}
+
+/// Build a PowerShell 7.x (PSResourceGet) command from a validated request.
+pub fn build_powershell7_command(request: &PackageRequest) -> Vec<String> {
+    let mut script = String::new();
+
+    let verb = match request.operation {
+        Operation::Install => "Install-PSResource",
+        Operation::Update => "Update-PSResource",
+        Operation::Uninstall => "Uninstall-PSResource",
+    };
+
+    append_raw(&mut script, verb);
+    append_flag_value(&mut script, "-Name", &request.package.id.0);
+    append_raw(&mut script, "-Confirm:$false");
+
+    match request.operation {
+        Operation::Install => {
+            if let Some(version) = request.package.version.as_deref() {
+                append_flag_value(&mut script, "-Version", version);
+            }
+        }
+        Operation::Update => append_raw(&mut script, "-Force"),
+        // Uninstall removes the installed resource without pinning a version.
+        Operation::Uninstall => {}
+    }
+
+    if !matches!(request.operation, Operation::Uninstall) {
+        append_raw(&mut script, "-TrustRepository");
+        append_raw(&mut script, "-AcceptLicense");
+
+        if request.options.pre_release {
+            append_raw(&mut script, "-Prerelease");
+        }
+
+        match request.options.scope {
+            Some(Scope::Machine) => append_raw(&mut script, "-Scope AllUsers"),
+            Some(Scope::User) | None => append_raw(&mut script, "-Scope CurrentUser"),
+        }
+    }
+
+    for param in &request.options.custom_parameters {
+        if !param.is_empty() {
+            append_raw(&mut script, &param.0);
+        }
+    }
+
+    vec![
+        "pwsh.exe".to_owned(),
+        "-NoProfile".to_owned(),
+        "-Command".to_owned(),
+        script,
+    ]
+}
+
+fn append_raw(script: &mut String, value: &str) {
+    if !script.is_empty() {
+        script.push(' ');
+    }
+    script.push_str(value);
+}
+
+fn append_flag_value(script: &mut String, flag_or_verb: &str, value: &str) {
+    append_raw(script, flag_or_verb);
+    append_raw(script, &quote_ps(value));
+}
+
+fn quote_ps(value: &str) -> String {
+    let escaped = value.replace('"', "`\"");
+    format!("\"{escaped}\"")
+}
+
+#[cfg(test)]
+mod tests {
+    use chrono::Utc;
+    use now_policy_api::*;
+
+    use super::*;
+
+    fn make_request(manager: ManagerName) -> PackageRequest {
+        PackageRequest {
+            request_kind: PackageRequestKind,
+            request_version: API_VERSION_STR.into(),
+            request_id: ResourceId::from("req-ps-1"),
+            created_at: Utc::now(),
+            operation: Operation::Install,
+            manager,
+            source: RequestSource {
+                name: "PSGallery".to_owned(),
+                url: None,
+            },
+            package: RequestPackage {
+                id: PackageIdentifier::from("Pester".to_owned()),
+                version: Some(VersionString("5.6.0".to_owned())),
+                architecture: None,
+                channel: None,
+            },
+            options: RequestOptions {
+                scope: Some(Scope::User),
+                interactive: false,
+                skip_hash_check: false,
+                pre_release: false,
+                custom_install_location: None,
+                custom_parameters: Vec::new(),
+                pre_operation_command: None,
+                post_operation_command: None,
+                kill_before_operation: Vec::new(),
+                uninstall_previous: false,
+                no_upgrade: false,
+            },
+            client: ClientContext {
+                transport: Transport::HttpNamedPipe,
+                requested_elevation: Elevation::Elevated,
+                effective_user: "DOMAIN\\user".to_owned(),
+                client_executable_path: "C:\\Program Files\\Devolutions\\Package Broker\\PackageBrokerClient.exe"
+                    .to_owned(),
+                client_version: "1.0.0".to_owned(),
+            },
+            include_command_preview: false,
+            capture_output: false,
+        }
+    }
+
+    /// The full PowerShell command line is `exe -NoProfile -Command <script>`.
+    fn script_of(cmd: &[String]) -> &str {
+        assert_eq!(cmd[1], "-NoProfile");
+        assert_eq!(cmd[2], "-Command");
+        &cmd[3]
+    }
+
+    #[test]
+    fn powershell5_install_matches_package_broker_client_semantics() {
+        let request = make_request(ManagerName::PowerShell);
+        let cmd = build_powershell5_command(&request);
+        let script = script_of(&cmd);
+        assert_eq!(cmd[0], "powershell.exe");
+        // verb, then -Name <id>, -Confirm:$false, -Force.
+        assert!(script.starts_with("Install-Module -Name \"Pester\" -Confirm:$false -Force"));
+        assert!(script.contains("-Scope CurrentUser"));
+        assert!(script.contains("-RequiredVersion \"5.6.0\""));
+        // The package broker client does not pin a repository for PowerShell operations.
+        assert!(!script.contains("-Repository"));
+    }
+
+    #[test]
+    fn powershell5_machine_scope_is_allusers() {
+        let mut request = make_request(ManagerName::PowerShell);
+        request.options.scope = Some(Scope::Machine);
+        let script = build_powershell5_command(&request)[3].clone();
+        assert!(script.contains("-Scope AllUsers"));
+    }
+
+    #[test]
+    fn powershell5_prerelease_and_skiphash() {
+        let mut request = make_request(ManagerName::PowerShell);
+        request.options.pre_release = true;
+        request.options.skip_hash_check = true;
+        let script = build_powershell5_command(&request)[3].clone();
+        assert!(script.contains("-AllowPrerelease"));
+        assert!(script.contains("-SkipPublisherCheck"));
+    }
+
+    #[test]
+    fn powershell5_uninstall_omits_scope_and_version() {
+        let mut request = make_request(ManagerName::PowerShell);
+        request.operation = Operation::Uninstall;
+        let script = build_powershell5_command(&request)[3].clone();
+        assert!(script.starts_with("Uninstall-Module -Name \"Pester\""));
+        assert!(!script.contains("-Scope"));
+        assert!(!script.contains("-RequiredVersion"));
+        assert!(!script.contains("-SkipPublisherCheck"));
+    }
+
+    #[test]
+    fn powershell7_install_matches_package_broker_client_semantics() {
+        let request = make_request(ManagerName::PowerShell7);
+        let cmd = build_powershell7_command(&request);
+        let script = script_of(&cmd);
+        assert_eq!(cmd[0], "pwsh.exe");
+        assert!(script.starts_with("Install-PSResource -Name \"Pester\" -Confirm:$false"));
+        assert!(script.contains("-Version \"5.6.0\""));
+        assert!(script.contains("-TrustRepository"));
+        assert!(script.contains("-AcceptLicense"));
+        assert!(script.contains("-Scope CurrentUser"));
+        assert!(!script.contains("-Repository"));
+    }
+
+    #[test]
+    fn powershell7_update_uses_force_not_version() {
+        let mut request = make_request(ManagerName::PowerShell7);
+        request.operation = Operation::Update;
+        let script = build_powershell7_command(&request)[3].clone();
+        assert!(script.contains("Update-PSResource"));
+        assert!(script.contains("-Force"));
+        assert!(!script.contains("-Version"));
+        assert!(script.contains("-TrustRepository"));
+    }
+
+    #[test]
+    fn powershell7_uninstall_omits_version_and_trust_flags() {
+        let mut request = make_request(ManagerName::PowerShell7);
+        request.operation = Operation::Uninstall;
+        let script = build_powershell7_command(&request)[3].clone();
+        assert!(script.starts_with("Uninstall-PSResource -Name \"Pester\" -Confirm:$false"));
+        // Uninstall must not pin a version (it would remove only the matching version,
+        // or fail if it does not match what is installed).
+        assert!(!script.contains("-Version"));
+        assert!(!script.contains("-TrustRepository"));
+        assert!(!script.contains("-AcceptLicense"));
+        assert!(!script.contains("-Scope"));
+    }
+
+    #[test]
+    fn powershell_custom_parameters_are_appended() {
+        let mut request = make_request(ManagerName::PowerShell7);
+        request.options.custom_parameters = vec![CustomParameterString("-Reinstall".to_owned())];
+        let script = build_powershell7_command(&request)[3].clone();
+        assert!(script.contains("-Reinstall"));
+    }
+}
diff --git a/devolutions-agent/src/broker/command_builder/winget.rs b/devolutions-agent/src/broker/command_builder/winget.rs
new file mode 100644
index 000000000..b985fcdc9
--- /dev/null
+++ b/devolutions-agent/src/broker/command_builder/winget.rs
@@ -0,0 +1,209 @@
+//! WinGet command-line builder.
+
+use now_policy_api::{Architecture, Operation, PackageRequest, Scope};
+
+use super::{set_if_specified, set_if_true};
+
+/// Build the WinGet command line from a validated request.
+///
+/// Returns the command as a list of arguments (first element is the executable).
+pub fn build_winget_command(request: &PackageRequest) -> Vec<String> {
+    let operation = match request.operation {
+        Operation::Install => "install",
+        Operation::Update => "upgrade",
+        Operation::Uninstall => "uninstall",
+    };
+
+    let mut command = vec![
+        "winget.exe".to_owned(),
+        operation.to_owned(),
+        "--id".to_owned(),
+        request.package.id.0.clone(),
+        "--source".to_owned(),
+        request.source.name.clone(),
+        "--exact".to_owned(),
+        "--accept-source-agreements".to_owned(),
+    ];
+
+    // Version pinning applies to install/update; uninstall removes whatever version is
+    // installed (pinning a possibly-mismatched version would fail the uninstall).
+    if !matches!(request.operation, Operation::Uninstall) {
+        set_if_specified(&mut command, "--version", request.package.version.as_deref());
+    }
+
+    set_if_specified(
+        &mut command,
+        "--architecture",
+        request.package.architecture.map(|arch| match arch {
+            Architecture::X86 => "x86",
+            Architecture::X64 => "x64",
+            Architecture::Arm64 => "arm64",
+            Architecture::Neutral => "neutral",
+        }),
+    );
+
+    set_if_specified(
+        &mut command,
+        "--scope",
+        match request.options.scope {
+            Some(Scope::User) => Some("user"),
+            Some(Scope::Machine) => Some("machine"),
+            None => None,
+        },
+    );
+
+    set_if_true(&mut command, "--interactive", request.options.interactive);
+
+    set_if_true(&mut command, "--silent", !request.options.interactive);
+    set_if_true(&mut command, "--disable-interactivity", !request.options.interactive);
+
+    set_if_true(&mut command, "--ignore-security-hash", request.options.skip_hash_check);
+
+    set_if_specified(
+        &mut command,
+        "--location",
+        request.options.custom_install_location.as_deref(),
+    );
+
+    // `--no-upgrade` only applies to install (skip if a version is already present).
+    if matches!(request.operation, Operation::Install) {
+        set_if_true(&mut command, "--no-upgrade", request.options.no_upgrade);
+    }
+
+    // `--uninstall-previous` applies to upgrade (remove the previous version).
+    if matches!(request.operation, Operation::Update) {
+        set_if_true(&mut command, "--uninstall-previous", request.options.uninstall_previous);
+    }
+
+    // Append any custom parameters.
+    for param in &request.options.custom_parameters {
+        if !param.is_empty() {
+            command.push(param.0.clone());
+        }
+    }
+
+    if matches!(request.operation, Operation::Install | Operation::Update) {
+        command.push("--accept-package-agreements".to_owned());
+    }
+
+    command
+}
+
+#[cfg(test)]
+mod tests {
+    use chrono::Utc;
+    use now_policy_api::*;
+
+    use super::*;
+
+    fn make_request() -> PackageRequest {
+        PackageRequest {
+            request_kind: PackageRequestKind,
+            request_version: API_VERSION_STR.into(),
+            request_id: ResourceId::from("req-1"),
+            created_at: Utc::now(),
+            operation: Operation::Install,
+            manager: ManagerName::Winget,
+            source: RequestSource {
+                name: "winget".to_owned(),
+                url: None,
+            },
+            package: RequestPackage {
+                id: PackageIdentifier::from("Mozilla.Firefox".to_owned()),
+                version: None,
+                architecture: None,
+                channel: None,
+            },
+            options: RequestOptions {
+                scope: None,
+                interactive: false,
+                skip_hash_check: false,
+                pre_release: false,
+                custom_install_location: None,
+                custom_parameters: Vec::new(),
+                pre_operation_command: None,
+                post_operation_command: None,
+                kill_before_operation: Vec::new(),
+                uninstall_previous: false,
+                no_upgrade: false,
+            },
+            client: ClientContext {
+                transport: Transport::HttpNamedPipe,
+                requested_elevation: Elevation::Elevated,
+                effective_user: "DOMAIN\\user".to_owned(),
+                client_executable_path: "C:\\Program Files\\Devolutions\\Package Broker\\PackageBrokerClient.exe"
+                    .to_owned(),
+                client_version: "1.0.0".to_owned(),
+            },
+            include_command_preview: false,
+            capture_output: false,
+        }
+    }
+
+    #[test]
+    fn test_basic_install_command() {
+        let request = make_request();
+        let cmd = build_winget_command(&request);
+        assert_eq!(cmd[0], "winget.exe");
+        assert_eq!(cmd[1], "install");
+        assert!(cmd.contains(&"--id".to_owned()));
+        assert!(cmd.contains(&"Mozilla.Firefox".to_owned()));
+        assert!(cmd.contains(&"--silent".to_owned()));
+        assert!(cmd.contains(&"--accept-source-agreements".to_owned()));
+    }
+
+    #[test]
+    fn test_upgrade_command() {
+        let mut request = make_request();
+        request.operation = Operation::Update;
+        request.package.version = Some(VersionString("120.0.0".to_owned()));
+
+        let cmd = build_winget_command(&request);
+        assert_eq!(cmd[1], "upgrade");
+        assert!(cmd.contains(&"--version".to_owned()));
+        assert!(cmd.contains(&"120.0.0".to_owned()));
+    }
+
+    #[test]
+    fn test_no_upgrade_flag_on_install_only() {
+        let mut request = make_request();
+        request.options.no_upgrade = true;
+
+        // Install: flag is emitted.
+        let cmd = build_winget_command(&request);
+        assert!(cmd.contains(&"--no-upgrade".to_owned()));
+
+        // Update: `--no-upgrade` is not an upgrade flag, so it must not appear.
+        request.operation = Operation::Update;
+        let cmd = build_winget_command(&request);
+        assert!(!cmd.contains(&"--no-upgrade".to_owned()));
+    }
+
+    #[test]
+    fn test_uninstall_previous_flag_on_update_only() {
+        let mut request = make_request();
+        request.options.uninstall_previous = true;
+
+        // Install: `--uninstall-previous` is an upgrade flag, so it must not appear.
+        let cmd = build_winget_command(&request);
+        assert!(!cmd.contains(&"--uninstall-previous".to_owned()));
+
+        // Update: flag is emitted.
+        request.operation = Operation::Update;
+        let cmd = build_winget_command(&request);
+        assert!(cmd.contains(&"--uninstall-previous".to_owned()));
+    }
+
+    #[test]
+    fn test_uninstall_omits_version() {
+        let mut request = make_request();
+        request.operation = Operation::Uninstall;
+        request.package.version = Some(VersionString("120.0.0".to_owned()));
+
+        // Even when the request carries a version, uninstall must not pin it.
+        let cmd = build_winget_command(&request);
+        assert_eq!(cmd[1], "uninstall");
+        assert!(!cmd.contains(&"--version".to_owned()));
+        assert!(!cmd.contains(&"120.0.0".to_owned()));
+    }
+}
diff --git a/devolutions-agent/src/broker/evaluator/constraints.rs b/devolutions-agent/src/broker/evaluator/constraints.rs
new file mode 100644
index 000000000..864265076
--- /dev/null
+++ b/devolutions-agent/src/broker/evaluator/constraints.rs
@@ -0,0 +1,229 @@
+//! Policy constraint checks.
+
+use now_policy::PolicyConstraints;
+use now_policy_api::PackageRequest;
+
+use super::RequestFlags;
+use super::wildcard::wildcard_any_vec;
+
+pub(super) fn constraints_pass(
+    constraints: &Option<PolicyConstraints>,
+    request: &PackageRequest,
+    flags: &RequestFlags,
+) -> bool {
+    let Some(c) = constraints else {
+        return true;
+    };
+
+    if !c.allow_interactive && request.options.interactive {
+        return false;
+    }
+    if !c.allow_skip_hash_check && request.options.skip_hash_check {
+        return false;
+    }
+    if !c.allow_pre_release && request.options.pre_release {
+        return false;
+    }
+    if !c.allow_custom_install_location && flags.has_custom_install_location {
+        return false;
+    }
+    if !c.allow_custom_parameters && flags.has_custom_parameters {
+        return false;
+    }
+    if !c.allow_pre_post_commands && flags.has_pre_post_commands {
+        return false;
+    }
+    if !c.allow_kill_before_operation && flags.has_kill_before_operation {
+        return false;
+    }
+    if !c.allow_uninstall_previous && flags.has_uninstall_previous {
+        return false;
+    }
+    // `allow_upgrade` gates the request's `no_upgrade` flag (skip-upgrade-if-present).
+    if !c.allow_upgrade && flags.no_upgrade {
+        return false;
+    }
+
+    // Check install location patterns.
+    if flags.has_custom_install_location
+        && !c.allowed_install_location_patterns.is_empty()
+        && !wildcard_any_vec(&flags.custom_install_location, &c.allowed_install_location_patterns)
+    {
+        return false;
+    }
+
+    // Check custom parameters.
+    for param in &flags.custom_parameters {
+        if !c.denied_custom_parameters.is_empty() && wildcard_any_vec(param, &c.denied_custom_parameters) {
+            return false;
+        }
+        if !c.allowed_custom_parameters.is_empty() || !c.allowed_custom_parameter_patterns.is_empty() {
+            let exact_allowed = c
+                .allowed_custom_parameters
+                .iter()
+                .any(|v| v.eq_ignore_ascii_case(param));
+            let pattern_allowed = wildcard_any_vec(param, &c.allowed_custom_parameter_patterns);
+            if !exact_allowed && !pattern_allowed {
+                return false;
+            }
+        }
+    }
+
+    true
+}
+
+#[cfg(test)]
+mod tests {
+    use chrono::Utc;
+    use now_policy::{CustomParameterString, StringPattern};
+    use now_policy_api as api;
+
+    use super::*;
+
+    fn request() -> PackageRequest {
+        PackageRequest {
+            request_kind: api::PackageRequestKind,
+            request_version: api::API_VERSION_STR.into(),
+            request_id: api::ResourceId::from("req-1"),
+            created_at: Utc::now(),
+            operation: api::Operation::Install,
+            manager: api::ManagerName::Winget,
+            source: api::RequestSource {
+                name: "winget".to_owned(),
+                url: None,
+            },
+            package: api::RequestPackage {
+                id: api::PackageIdentifier("Contoso.Tools".to_owned()),
+                version: None,
+                architecture: None,
+                channel: None,
+            },
+            options: api::RequestOptions {
+                scope: None,
+                interactive: false,
+                skip_hash_check: false,
+                pre_release: false,
+                custom_install_location: None,
+                custom_parameters: Vec::new(),
+                pre_operation_command: None,
+                post_operation_command: None,
+                kill_before_operation: Vec::new(),
+                uninstall_previous: false,
+                no_upgrade: false,
+            },
+            client: api::ClientContext {
+                transport: api::Transport::HttpNamedPipe,
+                requested_elevation: api::Elevation::Elevated,
+                effective_user: "DOMAIN\\user".to_owned(),
+                client_executable_path: "C:\\Program Files\\Devolutions\\Package Broker\\PackageBrokerClient.exe"
+                    .to_owned(),
+                client_version: "1.0.0".to_owned(),
+            },
+            include_command_preview: false,
+            capture_output: false,
+        }
+    }
+
+    fn flags() -> RequestFlags {
+        RequestFlags {
+            has_custom_parameters: false,
+            has_custom_install_location: false,
+            has_pre_post_commands: false,
+            has_kill_before_operation: false,
+            has_uninstall_previous: false,
+            no_upgrade: false,
+            custom_install_location: String::new(),
+            custom_parameters: Vec::new(),
+        }
+    }
+
+    #[test]
+    fn missing_constraints_are_permissive() {
+        assert!(constraints_pass(&None, &request(), &flags()));
+    }
+
+    #[test]
+    fn boolean_risky_option_gates_are_enforced() {
+        let mut request = request();
+        request.options.interactive = true;
+
+        let constraints = PolicyConstraints {
+            allow_interactive: false,
+            ..Default::default()
+        };
+
+        assert!(!constraints_pass(&Some(constraints), &request, &flags()));
+    }
+
+    #[test]
+    fn install_location_must_match_allowed_patterns_when_present() {
+        let constraints = PolicyConstraints {
+            allowed_install_location_patterns: vec![StringPattern("C:\\Tools\\*".to_owned())],
+            ..Default::default()
+        };
+
+        let mut matching_flags = flags();
+        matching_flags.has_custom_install_location = true;
+        matching_flags.custom_install_location = "C:\\Tools\\Contoso".to_owned();
+        assert!(constraints_pass(
+            &Some(constraints.clone()),
+            &request(),
+            &matching_flags
+        ));
+
+        let mut non_matching_flags = matching_flags;
+        non_matching_flags.custom_install_location = "D:\\Temp\\Contoso".to_owned();
+        assert!(!constraints_pass(&Some(constraints), &request(), &non_matching_flags));
+    }
+
+    #[test]
+    fn denied_custom_parameter_takes_precedence() {
+        let constraints = PolicyConstraints {
+            allowed_custom_parameter_patterns: vec![CustomParameterString("--*".to_owned())],
+            denied_custom_parameters: vec![CustomParameterString("--force".to_owned())],
+            ..Default::default()
+        };
+
+        let mut flags = flags();
+        flags.has_custom_parameters = true;
+        flags.custom_parameters = vec!["--force".to_owned()];
+
+        assert!(!constraints_pass(&Some(constraints), &request(), &flags));
+    }
+
+    #[test]
+    fn custom_parameter_allowlist_accepts_exact_or_pattern_matches() {
+        let constraints = PolicyConstraints {
+            allowed_custom_parameters: vec![CustomParameterString("--silent".to_owned())],
+            allowed_custom_parameter_patterns: vec![CustomParameterString("/log=*".to_owned())],
+            ..Default::default()
+        };
+
+        let mut exact_flags = flags();
+        exact_flags.has_custom_parameters = true;
+        exact_flags.custom_parameters = vec!["--SILENT".to_owned()];
+        assert!(constraints_pass(&Some(constraints.clone()), &request(), &exact_flags));
+
+        let mut pattern_flags = flags();
+        pattern_flags.has_custom_parameters = true;
+        pattern_flags.custom_parameters = vec!["/log=C:\\Temp\\install.log".to_owned()];
+        assert!(constraints_pass(&Some(constraints.clone()), &request(), &pattern_flags));
+
+        let mut rejected_flags = flags();
+        rejected_flags.has_custom_parameters = true;
+        rejected_flags.custom_parameters = vec!["--force".to_owned()];
+        assert!(!constraints_pass(&Some(constraints), &request(), &rejected_flags));
+    }
+
+    #[test]
+    fn allow_upgrade_controls_no_upgrade_requests() {
+        let constraints = PolicyConstraints {
+            allow_upgrade: false,
+            ..Default::default()
+        };
+        let mut flags = flags();
+        flags.no_upgrade = true;
+
+        assert!(!constraints_pass(&Some(constraints), &request(), &flags));
+    }
+}
diff --git a/devolutions-agent/src/broker/evaluator/matching.rs b/devolutions-agent/src/broker/evaluator/matching.rs
new file mode 100644
index 000000000..26720b93b
--- /dev/null
+++ b/devolutions-agent/src/broker/evaluator/matching.rs
@@ -0,0 +1,215 @@
+//! Rule matching primitives.
+
+use std::collections::BTreeSet;
+
+use now_policy::{Architecture, Elevation, ManagerName, Operation, PolicyRule, Scope};
+use now_policy_api::PackageRequest;
+
+use super::RequestFlags;
+use super::constraints::constraints_pass;
+use super::version::version_range_matches;
+use super::wildcard::wildcard_any;
+
+pub(super) fn rule_matches(
+    rule: &PolicyRule,
+    request: &PackageRequest,
+    flags: &RequestFlags,
+    effective_version: &str,
+) -> bool {
+    let m = &rule.match_criteria;
+
+    operations_match(request.operation.into(), &m.operations)
+        && managers_match(request.manager.into(), &m.managers)
+        && wildcard_any(&request.source.name, &m.sources)
+        && wildcard_any(&request.package.id, &m.package_identifiers)
+        && m.package_names.is_empty()
+        && string_in_set(effective_version, &m.versions)
+        && version_range_matches(effective_version, &m.version_range)
+        && scopes_match(request.options.scope.map(Into::into), &m.scopes)
+        && architectures_match(request.package.architecture.map(Into::into), &m.architectures)
+        && elevation_match(request.client.requested_elevation.into(), &m.elevation)
+        && bool_in_set(request.options.interactive, &m.interactive)
+        && bool_in_set(request.options.skip_hash_check, &m.skip_hash_check)
+        && bool_in_set(request.options.pre_release, &m.pre_release)
+        && bool_in_set(flags.has_custom_parameters, &m.has_custom_parameters)
+        && bool_in_set(flags.has_custom_install_location, &m.has_custom_install_location)
+        && bool_in_set(flags.has_pre_post_commands, &m.has_pre_post_commands)
+        && bool_in_set(flags.has_kill_before_operation, &m.has_kill_before_operation)
+        && bool_in_set(flags.has_uninstall_previous, &m.has_uninstall_previous)
+        && constraints_pass(&rule.constraints, request, flags)
+}
+
+fn operations_match(op: Operation, allowed: &BTreeSet<Operation>) -> bool {
+    allowed.is_empty() || allowed.contains(&op)
+}
+
+fn managers_match(name: ManagerName, allowed: &BTreeSet<ManagerName>) -> bool {
+    allowed.is_empty() || allowed.contains(&name)
+}
+
+fn scopes_match(scope: Option<Scope>, allowed: &BTreeSet<Scope>) -> bool {
+    if allowed.is_empty() {
+        return true;
+    }
+    match scope {
+        Some(s) => allowed.contains(&s),
+        None => true, // No scope specified = don't restrict.
+    }
+}
+
+fn architectures_match(arch: Option<Architecture>, allowed: &BTreeSet<Architecture>) -> bool {
+    if allowed.is_empty() {
+        return true;
+    }
+    match arch {
+        Some(a) => allowed.contains(&a),
+        None => true, // No architecture specified = don't restrict.
+    }
+}
+
+fn elevation_match(elev: Elevation, allowed: &BTreeSet<Elevation>) -> bool {
+    allowed.is_empty() || allowed.contains(&elev)
+}
+
+fn bool_in_set(value: bool, set: &BTreeSet<bool>) -> bool {
+    set.is_empty() || set.contains(&value)
+}
+
+fn string_in_set<S: AsRef<str>>(value: &str, set: &BTreeSet<S>) -> bool {
+    if set.is_empty() {
+        return true;
+    }
+    if value.is_empty() {
+        // If no version specified and set requires specific versions, don't match.
+        return false;
+    }
+    set.iter().any(|item| item.as_ref() == value)
+}
+
+#[cfg(test)]
+mod tests {
+    use chrono::Utc;
+    use now_policy::{Decision, PolicyMatch, ResourceId, StringPattern};
+    use now_policy_api as api;
+
+    use super::*;
+
+    fn request() -> PackageRequest {
+        PackageRequest {
+            request_kind: api::PackageRequestKind,
+            request_version: api::API_VERSION_STR.into(),
+            request_id: api::ResourceId::from("req-1"),
+            created_at: Utc::now(),
+            operation: api::Operation::Install,
+            manager: api::ManagerName::Winget,
+            source: api::RequestSource {
+                name: "winget".to_owned(),
+                url: None,
+            },
+            package: api::RequestPackage {
+                id: api::PackageIdentifier("Microsoft.VisualStudioCode".to_owned()),
+                version: Some(api::VersionString("1.2.3".to_owned())),
+                architecture: Some(api::Architecture::X64),
+                channel: None,
+            },
+            options: api::RequestOptions {
+                scope: Some(api::Scope::Machine),
+                interactive: false,
+                skip_hash_check: false,
+                pre_release: false,
+                custom_install_location: None,
+                custom_parameters: Vec::new(),
+                pre_operation_command: None,
+                post_operation_command: None,
+                kill_before_operation: Vec::new(),
+                uninstall_previous: false,
+                no_upgrade: false,
+            },
+            client: api::ClientContext {
+                transport: api::Transport::HttpNamedPipe,
+                requested_elevation: api::Elevation::Elevated,
+                effective_user: "DOMAIN\\user".to_owned(),
+                client_executable_path: "C:\\Program Files\\Devolutions\\Package Broker\\PackageBrokerClient.exe"
+                    .to_owned(),
+                client_version: "1.0.0".to_owned(),
+            },
+            include_command_preview: false,
+            capture_output: false,
+        }
+    }
+
+    fn rule(match_criteria: PolicyMatch) -> PolicyRule {
+        PolicyRule {
+            id: ResourceId::from("rule"),
+            enabled: true,
+            priority: 100,
+            decision: Decision::Allow,
+            reason: None,
+            match_criteria,
+            constraints: None,
+        }
+    }
+
+    fn matches(match_criteria: PolicyMatch) -> bool {
+        let request = request();
+        let flags = RequestFlags::from_request(&request);
+        rule_matches(&rule(match_criteria), &request, &flags, "1.2.3")
+    }
+
+    #[test]
+    fn empty_match_criteria_match_any_request() {
+        assert!(matches(PolicyMatch::default()));
+    }
+
+    #[test]
+    fn manager_operation_source_and_package_criteria_must_all_match() {
+        assert!(matches(PolicyMatch {
+            operations: BTreeSet::from([Operation::Install]),
+            managers: BTreeSet::from([ManagerName::Winget]),
+            sources: BTreeSet::from([StringPattern("winget".to_owned())]),
+            package_identifiers: BTreeSet::from([StringPattern("Microsoft.*Code".to_owned())]),
+            ..Default::default()
+        }));
+
+        assert!(!matches(PolicyMatch {
+            managers: BTreeSet::from([ManagerName::PowerShell]),
+            ..Default::default()
+        }));
+    }
+
+    #[test]
+    fn absent_scope_or_architecture_in_request_does_not_restrict_matching() {
+        let mut request = request();
+        request.options.scope = None;
+        request.package.architecture = None;
+        let flags = RequestFlags::from_request(&request);
+        let rule = rule(PolicyMatch {
+            scopes: BTreeSet::from([Scope::Machine]),
+            architectures: BTreeSet::from([Architecture::X64]),
+            ..Default::default()
+        });
+
+        assert!(rule_matches(&rule, &request, &flags, "1.2.3"));
+    }
+
+    #[test]
+    fn package_name_criteria_fail_closed_until_request_contains_display_name() {
+        assert!(!matches(PolicyMatch {
+            package_names: BTreeSet::from([StringPattern("Visual Studio Code".to_owned())]),
+            ..Default::default()
+        }));
+    }
+
+    #[test]
+    fn boolean_flags_match_request_options() {
+        let mut request = request();
+        request.options.interactive = true;
+        let flags = RequestFlags::from_request(&request);
+        let rule = rule(PolicyMatch {
+            interactive: BTreeSet::from([true]),
+            ..Default::default()
+        });
+
+        assert!(rule_matches(&rule, &request, &flags, "1.2.3"));
+    }
+}
diff --git a/devolutions-agent/src/broker/evaluator/mod.rs b/devolutions-agent/src/broker/evaluator/mod.rs
new file mode 100644
index 000000000..127cf8ffe
--- /dev/null
+++ b/devolutions-agent/src/broker/evaluator/mod.rs
@@ -0,0 +1,114 @@
+//! Policy evaluation engine.
+//!
+//! Implements the broker flow described in the package broker policies spec:
+//! 1. Match enabled rules against request
+//! 2. Sort by priority (lowest wins), deny wins on tie
+//! 3. Fall back to `enforcement.defaultDecision`
+
+use now_policy::{Decision, PolicyDocument};
+use now_policy_api::PackageRequest;
+
+mod constraints;
+mod matching;
+mod version;
+mod wildcard;
+
+#[cfg(test)]
+mod tests;
+
+/// Result of policy evaluation.
+#[derive(Debug, Clone)]
+pub struct PolicyDecision {
+    pub decision: Decision,
+    pub rule_id: String,
+    pub reason: String,
+}
+
+struct RequestFlags {
+    has_custom_parameters: bool,
+    has_custom_install_location: bool,
+    has_pre_post_commands: bool,
+    has_kill_before_operation: bool,
+    has_uninstall_previous: bool,
+    no_upgrade: bool,
+    custom_install_location: String,
+    custom_parameters: Vec<String>,
+}
+
+impl RequestFlags {
+    fn from_request(request: &PackageRequest) -> Self {
+        Self {
+            has_custom_parameters: !request.options.custom_parameters.is_empty(),
+            has_custom_install_location: request
+                .options
+                .custom_install_location
+                .as_deref()
+                .is_some_and(|location| !location.is_empty()),
+            has_pre_post_commands: request.options.pre_operation_command.is_some()
+                || request.options.post_operation_command.is_some(),
+            has_kill_before_operation: !request.options.kill_before_operation.is_empty(),
+            has_uninstall_previous: request.options.uninstall_previous,
+            no_upgrade: request.options.no_upgrade,
+            custom_install_location: request.options.custom_install_location.clone().unwrap_or_default(),
+            custom_parameters: request
+                .options
+                .custom_parameters
+                .iter()
+                .map(|parameter| parameter.as_ref().to_owned())
+                .collect(),
+        }
+    }
+}
+
+/// Evaluate a parsed request against a parsed policy document.
+///
+/// Both the policy and request should have already been deserialized into typed structs.
+/// This function performs the rule-matching logic only.
+pub fn evaluate(policy: &PolicyDocument, request: &PackageRequest) -> PolicyDecision {
+    let flags = RequestFlags::from_request(request);
+    let effective_version = version::get_effective_version(request);
+
+    let mut matched_rules: Vec<(&str, u32, Decision, &str)> = Vec::new();
+
+    for rule in &policy.rules {
+        if !rule.enabled {
+            continue;
+        }
+
+        if matching::rule_matches(rule, request, &flags, &effective_version) {
+            matched_rules.push((
+                &rule.id,
+                rule.priority,
+                rule.decision,
+                rule.reason.as_deref().unwrap_or("Rule matched."),
+            ));
+        }
+    }
+
+    if matched_rules.is_empty() {
+        return PolicyDecision {
+            decision: policy.enforcement.default_decision,
+            rule_id: "<default>".to_owned(),
+            reason: format!(
+                "No enabled rule matched; using defaultDecision '{}'.",
+                policy.enforcement.default_decision
+            ),
+        };
+    }
+
+    // Sort: lowest priority first, deny wins on tie.
+    matched_rules.sort_by(|a, b| {
+        a.1.cmp(&b.1).then_with(|| {
+            let a_is_deny = a.2 == Decision::Deny;
+            let b_is_deny = b.2 == Decision::Deny;
+            b_is_deny.cmp(&a_is_deny)
+        })
+    });
+
+    let winner = matched_rules[0];
+    PolicyDecision {
+        decision: winner.2,
+        rule_id: winner.0.to_owned(),
+        reason: winner.3.to_owned(),
+    }
+}
diff --git a/devolutions-agent/src/broker/evaluator/tests.rs b/devolutions-agent/src/broker/evaluator/tests.rs
new file mode 100644
index 000000000..50a03dbc3
--- /dev/null
+++ b/devolutions-agent/src/broker/evaluator/tests.rs
@@ -0,0 +1,214 @@
+#![allow(clippy::unwrap_used)]
+
+use std::collections::BTreeSet;
+
+use chrono::Utc;
+use now_policy::{
+    Decision, PackageBrokerPolicy, PolicyDocument, PolicyEnforcement, PolicyMatch, PolicyMetadata, PolicyRule,
+    PolicySchemaUri, ResourceId, RulePrecedence, SemanticVersion, StringPattern,
+};
+use now_policy_api::{self as api, PackageRequest};
+
+use super::evaluate;
+
+fn make_policy(default_decision: Decision, rules: Vec<PolicyRule>) -> PolicyDocument {
+    PolicyDocument {
+        _schema: PolicySchemaUri,
+        policy_version: SemanticVersion::from("1.0.0"),
+        policy_type: PackageBrokerPolicy,
+        metadata: PolicyMetadata {
+            id: ResourceId::from("test-policy"),
+            publisher: "Test".to_owned(),
+            revision: 1,
+            published_at: Utc::now(),
+            valid_from: None,
+            valid_until: None,
+            description: None,
+            support_url: None,
+        },
+        enforcement: PolicyEnforcement {
+            default_decision,
+            rule_precedence: RulePrecedence::PriorityThenDeny,
+            audit_mode: None,
+        },
+        rules,
+    }
+}
+
+fn make_request(operation: api::Operation, package_id: &str) -> PackageRequest {
+    PackageRequest {
+        request_kind: api::PackageRequestKind,
+        request_version: api::API_VERSION_STR.into(),
+        request_id: api::ResourceId::from("req-1"),
+        created_at: Utc::now(),
+        operation,
+        manager: api::ManagerName::Winget,
+        source: api::RequestSource {
+            name: "winget".to_owned(),
+            url: None,
+        },
+        package: api::RequestPackage {
+            id: api::PackageIdentifier(package_id.to_owned()),
+            version: None,
+            architecture: None,
+            channel: None,
+        },
+        options: api::RequestOptions {
+            scope: None,
+            interactive: false,
+            skip_hash_check: false,
+            pre_release: false,
+            custom_install_location: None,
+            custom_parameters: Vec::new(),
+            pre_operation_command: None,
+            post_operation_command: None,
+            kill_before_operation: Vec::new(),
+            uninstall_previous: false,
+            no_upgrade: false,
+        },
+        client: api::ClientContext {
+            transport: api::Transport::HttpNamedPipe,
+            requested_elevation: api::Elevation::Elevated,
+            effective_user: "DOMAIN\\user".to_owned(),
+            client_executable_path: "C:\\Program Files\\Devolutions\\Package Broker\\PackageBrokerClient.exe"
+                .to_owned(),
+            client_version: "1.0.0".to_owned(),
+        },
+        include_command_preview: false,
+        capture_output: false,
+    }
+}
+
+#[test]
+fn allow_matching_package() {
+    let policy = make_policy(
+        Decision::Deny,
+        vec![PolicyRule {
+            id: ResourceId::from("allow-firefox"),
+            enabled: true,
+            priority: 100,
+            decision: Decision::Allow,
+            reason: Some("Firefox is allowed.".to_owned()),
+            match_criteria: PolicyMatch {
+                package_identifiers: BTreeSet::from([StringPattern("Mozilla.Firefox".to_owned())]),
+                ..Default::default()
+            },
+            constraints: None,
+        }],
+    );
+
+    let request = make_request(api::Operation::Install, "Mozilla.Firefox");
+    let result = evaluate(&policy, &request);
+    assert_eq!(result.decision, Decision::Allow);
+    assert_eq!(result.rule_id, "allow-firefox");
+}
+
+#[test]
+fn deny_unmatched_package() {
+    let policy = make_policy(
+        Decision::Deny,
+        vec![PolicyRule {
+            id: ResourceId::from("allow-firefox"),
+            enabled: true,
+            priority: 100,
+            decision: Decision::Allow,
+            reason: None,
+            match_criteria: PolicyMatch {
+                package_identifiers: BTreeSet::from([StringPattern("Mozilla.Firefox".to_owned())]),
+                ..Default::default()
+            },
+            constraints: None,
+        }],
+    );
+
+    let request = make_request(api::Operation::Install, "Evil.Malware");
+    let result = evaluate(&policy, &request);
+    assert_eq!(result.decision, Decision::Deny);
+    assert_eq!(result.rule_id, "<default>");
+}
+
+#[test]
+fn disabled_rules_are_ignored() {
+    let policy = make_policy(
+        Decision::Deny,
+        vec![PolicyRule {
+            id: ResourceId::from("disabled-allow"),
+            enabled: false,
+            priority: 1,
+            decision: Decision::Allow,
+            reason: None,
+            match_criteria: PolicyMatch {
+                package_identifiers: BTreeSet::from([StringPattern("Some.Package".to_owned())]),
+                ..Default::default()
+            },
+            constraints: None,
+        }],
+    );
+
+    let request = make_request(api::Operation::Install, "Some.Package");
+    let result = evaluate(&policy, &request);
+    assert_eq!(result.decision, Decision::Deny);
+    assert_eq!(result.rule_id, "<default>");
+}
+
+#[test]
+fn lower_priority_number_wins() {
+    let policy = make_policy(
+        Decision::Deny,
+        vec![
+            PolicyRule {
+                id: ResourceId::from("allow-low-priority"),
+                enabled: true,
+                priority: 200,
+                decision: Decision::Allow,
+                reason: None,
+                match_criteria: PolicyMatch::default(),
+                constraints: None,
+            },
+            PolicyRule {
+                id: ResourceId::from("deny-high-priority"),
+                enabled: true,
+                priority: 100,
+                decision: Decision::Deny,
+                reason: None,
+                match_criteria: PolicyMatch::default(),
+                constraints: None,
+            },
+        ],
+    );
+
+    let result = evaluate(&policy, &make_request(api::Operation::Install, "Some.Package"));
+    assert_eq!(result.decision, Decision::Deny);
+    assert_eq!(result.rule_id, "deny-high-priority");
+}
+
+#[test]
+fn deny_wins_priority_ties() {
+    let policy = make_policy(
+        Decision::Allow,
+        vec![
+            PolicyRule {
+                id: ResourceId::from("allow-tie"),
+                enabled: true,
+                priority: 100,
+                decision: Decision::Allow,
+                reason: None,
+                match_criteria: PolicyMatch::default(),
+                constraints: None,
+            },
+            PolicyRule {
+                id: ResourceId::from("deny-tie"),
+                enabled: true,
+                priority: 100,
+                decision: Decision::Deny,
+                reason: None,
+                match_criteria: PolicyMatch::default(),
+                constraints: None,
+            },
+        ],
+    );
+
+    let result = evaluate(&policy, &make_request(api::Operation::Install, "Some.Package"));
+    assert_eq!(result.decision, Decision::Deny);
+    assert_eq!(result.rule_id, "deny-tie");
+}
diff --git a/devolutions-agent/src/broker/evaluator/version.rs b/devolutions-agent/src/broker/evaluator/version.rs
new file mode 100644
index 000000000..452187fcb
--- /dev/null
+++ b/devolutions-agent/src/broker/evaluator/version.rs
@@ -0,0 +1,107 @@
+//! Request version matching helpers.
+
+use now_policy::VersionRange;
+use now_policy_api::PackageRequest;
+
+pub(super) fn get_effective_version(request: &PackageRequest) -> String {
+    match &request.package.version {
+        Some(v) => v.0.clone(),
+        None => String::new(),
+    }
+}
+
+pub(super) fn version_range_matches(version: &str, range: &Option<VersionRange>) -> bool {
+    let Some(range) = range else {
+        return true;
+    };
+    if version.is_empty() {
+        return false;
+    }
+    if version.contains('-') && !range.include_prerelease {
+        return false;
+    }
+    if let Some(min) = &range.min_version
+        && !min.is_empty()
+        && compare_versions(version, min) < 0
+    {
+        return false;
+    }
+    if let Some(max) = &range.max_version
+        && !max.is_empty()
+        && compare_versions(version, max) > 0
+    {
+        return false;
+    }
+    true
+}
+
+/// Simple numeric version comparison (e.g. "1.2.3" vs "1.2.4").
+fn compare_versions(a: &str, b: &str) -> i32 {
+    let parse = |s: &str| -> Vec<u64> {
+        s.split(['.', '-', '+'])
+            .filter_map(|part| part.parse::<u64>().ok())
+            .collect()
+    };
+
+    let va = parse(a);
+    let vb = parse(b);
+    let len = va.len().max(vb.len());
+
+    for i in 0..len {
+        let pa = va.get(i).copied().unwrap_or(0);
+        let pb = vb.get(i).copied().unwrap_or(0);
+        if pa < pb {
+            return -1;
+        }
+        if pa > pb {
+            return 1;
+        }
+    }
+    0
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn range(min: Option<&str>, max: Option<&str>, include_prerelease: bool) -> Option<VersionRange> {
+        Some(VersionRange {
+            min_version: min.map(ToOwned::to_owned),
+            max_version: max.map(ToOwned::to_owned),
+            include_prerelease,
+        })
+    }
+
+    #[test]
+    fn absent_range_accepts_empty_or_present_versions() {
+        assert!(version_range_matches("", &None));
+        assert!(version_range_matches("1.2.3", &None));
+    }
+
+    #[test]
+    fn configured_range_rejects_missing_version() {
+        assert!(!version_range_matches("", &range(Some("1.0.0"), None, false)));
+    }
+
+    #[test]
+    fn inclusive_min_and_max_bounds_are_enforced() {
+        let range = range(Some("1.2.0"), Some("1.4.0"), false);
+        assert!(!version_range_matches("1.1.9", &range));
+        assert!(version_range_matches("1.2.0", &range));
+        assert!(version_range_matches("1.3.5", &range));
+        assert!(version_range_matches("1.4.0", &range));
+        assert!(!version_range_matches("1.4.1", &range));
+    }
+
+    #[test]
+    fn prerelease_versions_require_explicit_opt_in() {
+        assert!(!version_range_matches(
+            "1.2.3-beta.1",
+            &range(Some("1.0.0"), Some("2.0.0"), false)
+        ));
+        assert!(version_range_matches(
+            "1.2.3-beta.1",
+            &range(Some("1.0.0"), Some("2.0.0"), true)
+        ));
+    }
+}
diff --git a/devolutions-agent/src/broker/evaluator/wildcard.rs b/devolutions-agent/src/broker/evaluator/wildcard.rs
new file mode 100644
index 000000000..68e99df85
--- /dev/null
+++ b/devolutions-agent/src/broker/evaluator/wildcard.rs
@@ -0,0 +1,50 @@
+//! Case-insensitive wildcard matching helpers.
+
+use std::collections::BTreeSet;
+
+pub(super) fn wildcard_any<S: AsRef<str>>(value: &str, patterns: &BTreeSet<S>) -> bool {
+    patterns.is_empty() || patterns.iter().any(|pattern| wildcard_match(value, pattern.as_ref()))
+}
+
+pub(super) fn wildcard_any_vec<S: AsRef<str>>(value: &str, patterns: &[S]) -> bool {
+    patterns.iter().any(|pattern| wildcard_match(value, pattern.as_ref()))
+}
+
+fn wildcard_match(value: &str, pattern: &str) -> bool {
+    // Convert glob pattern to regex: escape everything except *, which becomes .*
+    let regex_pattern = format!("^{}$", regex::escape(pattern).replace(r"\*", ".*"));
+    regex::RegexBuilder::new(&regex_pattern)
+        .case_insensitive(true)
+        .build()
+        .is_ok_and(|re| re.is_match(value))
+}
+
+#[cfg(test)]
+mod tests {
+    use std::collections::BTreeSet;
+
+    use now_policy::StringPattern;
+
+    use super::*;
+
+    #[test]
+    fn empty_pattern_set_matches_everything() {
+        assert!(wildcard_any(
+            "Microsoft.VisualStudioCode",
+            &BTreeSet::<StringPattern>::new()
+        ));
+    }
+
+    #[test]
+    fn wildcard_match_is_case_insensitive() {
+        let patterns = BTreeSet::from([StringPattern("microsoft.*code".to_owned())]);
+        assert!(wildcard_any("Microsoft.VisualStudioCode", &patterns));
+    }
+
+    #[test]
+    fn wildcard_does_not_treat_regex_metacharacters_as_regex() {
+        let patterns = BTreeSet::from([StringPattern("Contoso.Tools+".to_owned())]);
+        assert!(wildcard_any("Contoso.Tools+", &patterns));
+        assert!(!wildcard_any("Contoso.Toolss", &patterns));
+    }
+}
diff --git a/devolutions-agent/src/broker/executor/mod.rs b/devolutions-agent/src/broker/executor/mod.rs
new file mode 100644
index 000000000..3bb49e10f
--- /dev/null
+++ b/devolutions-agent/src/broker/executor/mod.rs
@@ -0,0 +1,85 @@
+//! Command execution module.
+//!
+//! Handles running commands under the specified user identity.
+
+use async_trait::async_trait;
+use now_policy_api::{Elevation, Scope};
+
+mod output;
+
+#[cfg(windows)]
+mod windows;
+
+pub use output::{ExecutionOutput, MAX_CAPTURED_OUTPUT_BYTES, describe_exit_code, tail_utf8};
+#[cfg(windows)]
+pub use windows::WindowsExecutor;
+
+/// Execution context passed from the server to the executor.
+///
+/// Describes the full ordered plan the broker runs on the user's behalf:
+/// process kills, an optional pre-operation shell command, the main
+/// package-manager command, and an optional post-operation shell command.
+#[derive(Debug, Clone)]
+pub struct ExecutionContext {
+    /// Process image names to terminate before the operation (best-effort).
+    pub kill_processes: Vec<String>,
+    /// Optional shell command to run before the main command (`cmd.exe /S /C`).
+    pub pre_command: Option<String>,
+    /// The main package-manager command line as separate arguments (exe + args).
+    pub command: Vec<String>,
+    /// Optional shell command to run after the main command (`cmd.exe /S /C`).
+    pub post_command: Option<String>,
+    /// Windows identity of the target user (e.g., `DOMAIN\username`).
+    pub effective_user: String,
+    /// Requested elevation level.
+    pub elevation: Elevation,
+    /// Installation scope (machine scope requires elevation).
+    pub scope: Option<Scope>,
+    /// When true, capture the main command's combined stdout+stderr.
+    pub capture_output: bool,
+}
+
+/// Trait for command execution strategies.
+#[async_trait]
+pub trait CommandExecutor: Send + Sync {
+    /// Execute a command under the given context.
+    ///
+    /// Returns the main command's exit code and captured output on success.
+    /// The method blocks (async) until the spawned process exits or a fatal error occurs during launch.
+    async fn execute(&self, ctx: &ExecutionContext) -> anyhow::Result<ExecutionOutput>;
+}
+
+/// Dry-run executor that only logs commands without running them.
+pub struct DryRunExecutor;
+
+#[async_trait]
+impl CommandExecutor for DryRunExecutor {
+    async fn execute(&self, ctx: &ExecutionContext) -> anyhow::Result<ExecutionOutput> {
+        tracing::info!(
+            effective_user = %ctx.effective_user,
+            kill_processes = ?ctx.kill_processes,
+            pre_command = ?ctx.pre_command,
+            command = %ctx.command.join(" "),
+            post_command = ?ctx.post_command,
+            elevation = %ctx.elevation,
+            "Dry-run: would execute plan"
+        );
+        Ok(ExecutionOutput::default())
+    }
+}
+
+/// Create the appropriate command executor for the current platform.
+///
+/// On Windows, returns a `WindowsExecutor` that uses raw Win32 APIs.
+/// On other platforms, returns a `DryRunExecutor` since named pipes
+/// and WinGet are not available.
+pub fn create_platform_executor() -> Box<dyn CommandExecutor> {
+    #[cfg(windows)]
+    {
+        Box::new(WindowsExecutor::new())
+    }
+    #[cfg(not(windows))]
+    {
+        Box::new(DryRunExecutor)
+    }
+}
diff --git a/devolutions-agent/src/broker/executor/output.rs b/devolutions-agent/src/broker/executor/output.rs
new file mode 100644
index 000000000..901ee1a17
--- /dev/null
+++ b/devolutions-agent/src/broker/executor/output.rs
@@ -0,0 +1,413 @@
+//! Output capture and exit-code helpers.
+
+/// Maximum amount of captured process output retained (the tail is kept).
+pub const MAX_CAPTURED_OUTPUT_BYTES: usize = 10 * 1024;
+
+/// Outcome of executing a command plan: the main command's exit code and a
+/// tail-truncated, UTF-8 capture of its combined stdout+stderr.
+#[derive(Debug, Clone, Default)]
+pub struct ExecutionOutput {
+    pub exit_code: i32,
+    pub stdout: String,
+}
+
+/// Keep the last [`MAX_CAPTURED_OUTPUT_BYTES`] of `bytes`, decoded lossily as UTF-8.
+///
+/// When truncated, a marker line is prepended so consumers can tell output was dropped.
+pub fn tail_utf8(bytes: &[u8]) -> String {
+    if bytes.len() <= MAX_CAPTURED_OUTPUT_BYTES {
+        return String::from_utf8_lossy(bytes).into_owned();
+    }
+    let tail = &bytes[bytes.len() - MAX_CAPTURED_OUTPUT_BYTES..];
+    format!(
+        "[... output truncated to last {} KiB ...]\n{}",
+        MAX_CAPTURED_OUTPUT_BYTES / 1024,
+        String::from_utf8_lossy(tail)
+    )
+}
+
+/// Official WinGet HRESULT messages from `AppInstallerErrors.h`.
+const WINGET_EXIT_CODE_MESSAGES: &[(u32, &str)] = &[
+    (0x8A15_0001, "WinGet: an internal error occurred"),
+    (0x8A15_0002, "WinGet: invalid command-line arguments"),
+    (0x8A15_0003, "WinGet: command failed"),
+    (0x8A15_0004, "WinGet: failed to load the manifest"),
+    (0x8A15_0005, "WinGet: operation was interrupted by a control signal"),
+    (0x8A15_0006, "WinGet: shell execution install failed"),
+    (0x8A15_0007, "WinGet: manifest version is not supported"),
+    (0x8A15_0008, "WinGet: download failed"),
+    (0x8A15_0009, "WinGet: cannot write to an older source index"),
+    (0x8A15_000A, "WinGet: source index integrity is compromised"),
+    (0x8A15_000B, "WinGet: sources are invalid"),
+    (0x8A15_000C, "WinGet: source name already exists"),
+    (0x8A15_000D, "WinGet: source type is invalid"),
+    (0x8A15_000E, "WinGet: package is a bundle"),
+    (0x8A15_000F, "WinGet: source data is missing"),
+    (0x8A15_0010, "WinGet: no applicable installer found"),
+    (0x8A15_0011, "WinGet: installer hash mismatch"),
+    (0x8A15_0012, "WinGet: source name does not exist"),
+    (0x8A15_0013, "WinGet: source argument already exists"),
+    (0x8A15_0014, "WinGet: no package matched the query"),
+    (0x8A15_0015, "WinGet: no sources are configured"),
+    (0x8A15_0016, "WinGet: multiple packages matched the query"),
+    (0x8A15_0017, "WinGet: no manifest found"),
+    (0x8A15_0018, "WinGet: extension failed to provide package data"),
+    (0x8A15_0019, "WinGet: command requires administrator privileges"),
+    (0x8A15_001A, "WinGet: source is not secure"),
+    (0x8A15_001B, "WinGet: Microsoft Store source is blocked by policy"),
+    (0x8A15_001C, "WinGet: Microsoft Store app is blocked by policy"),
+    (0x8A15_001D, "WinGet: experimental feature is disabled"),
+    (0x8A15_001E, "WinGet: Microsoft Store install failed"),
+    (0x8A15_001F, "WinGet: shell completion input was invalid"),
+    (0x8A15_0020, "WinGet: failed to initialize YAML parser"),
+    (0x8A15_0021, "WinGet: YAML contains an invalid mapping key"),
+    (0x8A15_0022, "WinGet: YAML contains a duplicate mapping key"),
+    (0x8A15_0023, "WinGet: YAML operation is invalid"),
+    (0x8A15_0024, "WinGet: failed to build YAML document"),
+    (0x8A15_0025, "WinGet: YAML emitter state is invalid"),
+    (0x8A15_0026, "WinGet: YAML data is invalid"),
+    (0x8A15_0027, "WinGet: YAML parser failed"),
+    (0x8A15_0028, "WinGet: manifest validation reported warnings"),
+    (0x8A15_0029, "WinGet: manifest validation failed"),
+    (0x8A15_002A, "WinGet: manifest is invalid"),
+    (0x8A15_002B, "WinGet: update is not applicable"),
+    (0x8A15_002C, "WinGet: one or more updates failed"),
+    (0x8A15_002D, "WinGet: installer security check failed"),
+    (0x8A15_002E, "WinGet: downloaded file size does not match the manifest"),
+    (0x8A15_002F, "WinGet: uninstall information was not found"),
+    (0x8A15_0030, "WinGet: uninstall command failed"),
+    (0x8A15_0031, "WinGet: ICU break iterator failed"),
+    (0x8A15_0032, "WinGet: ICU case mapping failed"),
+    (0x8A15_0033, "WinGet: ICU regular expression failed"),
+    (0x8A15_0034, "WinGet: one or more imported packages failed to install"),
+    (0x8A15_0035, "WinGet: not all requested packages were found"),
+    (0x8A15_0036, "WinGet: JSON file is invalid"),
+    (0x8A15_0037, "WinGet: source is not remote"),
+    (0x8A15_0038, "WinGet: REST source is not supported"),
+    (0x8A15_0039, "WinGet: REST source returned invalid data"),
+    (0x8A15_003A, "WinGet: operation is blocked by policy"),
+    (0x8A15_003B, "WinGet: REST API returned an internal error"),
+    (0x8A15_003C, "WinGet: REST source URL is invalid"),
+    (0x8A15_003D, "WinGet: REST API returned an unsupported MIME type"),
+    (0x8A15_003E, "WinGet: REST source version is invalid"),
+    (0x8A15_003F, "WinGet: source data integrity check failed"),
+    (0x8A15_0040, "WinGet: failed to read stream data"),
+    (0x8A15_0041, "WinGet: package agreements were not accepted"),
+    (0x8A15_0042, "WinGet: failed to read prompt input"),
+    (0x8A15_0043, "WinGet: source request is not supported"),
+    (0x8A15_0044, "WinGet: REST API endpoint was not found"),
+    (0x8A15_0045, "WinGet: failed to open source"),
+    (0x8A15_0046, "WinGet: source agreements were not accepted"),
+    (0x8A15_0047, "WinGet: custom header exceeds the maximum length"),
+    (0x8A15_0048, "WinGet: resource file is missing"),
+    (0x8A15_0049, "WinGet: MSI install failed"),
+    (0x8A15_004A, "WinGet: msiexec argument is invalid"),
+    (0x8A15_004B, "WinGet: failed to open all sources"),
+    (0x8A15_004C, "WinGet: dependency validation failed"),
+    (0x8A15_004D, "WinGet: package is missing"),
+    (0x8A15_004E, "WinGet: table column is invalid"),
+    (
+        0x8A15_004F,
+        "WinGet: upgrade version is not newer than the installed version",
+    ),
+    (0x8A15_0050, "WinGet: upgrade version is unknown"),
+    (0x8A15_0051, "WinGet: ICU conversion failed"),
+    (0x8A15_0052, "WinGet: portable install failed"),
+    (0x8A15_0053, "WinGet: portable package does not support reparse points"),
+    (0x8A15_0054, "WinGet: portable package already exists"),
+    (0x8A15_0055, "WinGet: portable symlink path is a directory"),
+    (0x8A15_0056, "WinGet: installer prohibits elevation"),
+    (0x8A15_0057, "WinGet: portable uninstall failed"),
+    (0x8A15_0058, "WinGet: installed version validation failed"),
+    (0x8A15_0059, "WinGet: argument is not supported"),
+    (0x8A15_005A, "WinGet: argument contains an embedded null character"),
+    (0x8A15_005B, "WinGet: nested installer was not found"),
+    (0x8A15_005C, "WinGet: failed to extract archive"),
+    (0x8A15_005D, "WinGet: nested installer path is invalid"),
+    (0x8A15_005E, "WinGet: pinned certificate does not match"),
+    (0x8A15_005F, "WinGet: install location is required"),
+    (0x8A15_0060, "WinGet: archive scan failed"),
+    (0x8A15_0061, "WinGet: package is already installed"),
+    (0x8A15_0062, "WinGet: pin already exists"),
+    (0x8A15_0063, "WinGet: pin does not exist"),
+    (0x8A15_0064, "WinGet: failed to open pinning index"),
+    (0x8A15_0065, "WinGet: one or more installs failed"),
+    (0x8A15_0066, "WinGet: one or more uninstalls failed"),
+    (0x8A15_0067, "WinGet: not all single-package queries were found"),
+    (0x8A15_0068, "WinGet: package is pinned"),
+    (0x8A15_0069, "WinGet: package is a stub"),
+    (0x8A15_006A, "WinGet: application termination signal was received"),
+    (0x8A15_006B, "WinGet: failed to download dependencies"),
+    (0x8A15_006C, "WinGet: download command is prohibited"),
+    (0x8A15_006D, "WinGet: service is unavailable"),
+    (0x8A15_006E, "WinGet: resume identifier was not found"),
+    (0x8A15_006F, "WinGet: client version does not match the checkpoint"),
+    (0x8A15_0070, "WinGet: resume state is invalid"),
+    (0x8A15_0071, "WinGet: failed to open checkpoint index"),
+    (0x8A15_0072, "WinGet: resume limit was exceeded"),
+    (0x8A15_0073, "WinGet: authentication information is invalid"),
+    (0x8A15_0074, "WinGet: authentication type is not supported"),
+    (0x8A15_0075, "WinGet: authentication failed"),
+    (0x8A15_0076, "WinGet: interactive authentication is required"),
+    (0x8A15_0077, "WinGet: authentication was cancelled by the user"),
+    (0x8A15_0078, "WinGet: authentication used the wrong account"),
+    (0x8A15_0079, "WinGet: repair information was not found"),
+    (0x8A15_007A, "WinGet: repair is not applicable"),
+    (0x8A15_007B, "WinGet: repair command failed"),
+    (0x8A15_007C, "WinGet: repair is not supported"),
+    (0x8A15_007D, "WinGet: repair is prohibited in administrator context"),
+    (0x8A15_007E, "WinGet: SQLite connection was terminated"),
+    (0x8A15_007F, "WinGet: display catalog API failed"),
+    (0x8A15_0080, "WinGet: no applicable display catalog package found"),
+    (0x8A15_0081, "WinGet: SFS client API failed"),
+    (0x8A15_0082, "WinGet: no applicable SFS client package found"),
+    (0x8A15_0083, "WinGet: licensing API failed"),
+    (0x8A15_0084, "WinGet: SFS client package is not supported"),
+    (0x8A15_0085, "WinGet: licensing API returned forbidden"),
+    (0x8A15_0086, "WinGet: installer file is empty"),
+    (0x8A15_0087, "WinGet: font install failed"),
+    (0x8A15_0088, "WinGet: font file is not supported"),
+    (0x8A15_0089, "WinGet: font is already installed"),
+    (0x8A15_008A, "WinGet: font file was not found"),
+    (0x8A15_008B, "WinGet: font uninstall failed"),
+    (0x8A15_008C, "WinGet: font validation failed"),
+    (0x8A15_008D, "WinGet: font rollback failed"),
+    (
+        0x8A15_008E,
+        "WinGet: installed package uses a different installer technology",
+    ),
+    (0x8A15_0101, "WinGet installer: package is currently in use"),
+    (0x8A15_0102, "WinGet installer: another install is already in progress"),
+    (0x8A15_0103, "WinGet installer: a required file is in use"),
+    (0x8A15_0104, "WinGet installer: a dependency is missing"),
+    (0x8A15_0105, "WinGet installer: disk is full"),
+    (0x8A15_0106, "WinGet installer: memory is insufficient"),
+    (0x8A15_0107, "WinGet installer: network is unavailable"),
+    (0x8A15_0108, "WinGet installer: contact support"),
+    (0x8A15_0109, "WinGet installer: reboot required to finish installation"),
+    (0x8A15_010A, "WinGet installer: reboot required before installation"),
+    (0x8A15_010B, "WinGet installer: reboot was initiated"),
+    (0x8A15_010C, "WinGet installer: install was cancelled by the user"),
+    (0x8A15_010D, "WinGet installer: package is already installed"),
+    (0x8A15_010E, "WinGet installer: downgrade is not allowed"),
+    (0x8A15_010F, "WinGet installer: install is blocked by policy"),
+    (0x8A15_0110, "WinGet installer: dependency install failed"),
+    (
+        0x8A15_0111,
+        "WinGet installer: package is in use by another application",
+    ),
+    (0x8A15_0112, "WinGet installer: invalid installer parameter"),
+    (0x8A15_0113, "WinGet installer: system is not supported"),
+    (0x8A15_0114, "WinGet installer: upgrade is not supported"),
+    (0x8A15_0115, "WinGet installer: custom installer error"),
+    (0x8A15_0201, "WinGet installed status: uninstall entry was not found"),
+    (
+        0x0A15_0202,
+        "WinGet installed status: install location check is not applicable",
+    ),
+    (0x8A15_0203, "WinGet installed status: install location was not found"),
+    (0x8A15_0204, "WinGet installed status: file hash mismatch"),
+    (0x8A15_0205, "WinGet installed status: file was not found"),
+    (
+        0x0A15_0206,
+        "WinGet installed status: file found but hash was not checked",
+    ),
+    (0x8A15_0207, "WinGet installed status: file access failed"),
+    (0x8A15_C001, "WinGet configuration: configuration file is invalid"),
+    (0x8A15_C002, "WinGet configuration: YAML is invalid"),
+    (0x8A15_C003, "WinGet configuration: field type is invalid"),
+    (0x8A15_C004, "WinGet configuration: file version is not supported"),
+    (0x8A15_C005, "WinGet configuration: failed to apply configuration set"),
+    (0x8A15_C006, "WinGet configuration: duplicate identifier"),
+    (0x8A15_C007, "WinGet configuration: dependency is missing"),
+    (0x8A15_C008, "WinGet configuration: dependency is unsatisfied"),
+    (0x8A15_C009, "WinGet configuration: assertion failed"),
+    (
+        0x8A15_C00A,
+        "WinGet configuration: configuration unit was manually skipped",
+    ),
+    (0x8A15_C00B, "WinGet configuration: warning was not accepted"),
+    (0x8A15_C00C, "WinGet configuration: dependency cycle detected"),
+    (0x8A15_C00D, "WinGet configuration: field value is invalid"),
+    (0x8A15_C00E, "WinGet configuration: required field is missing"),
+    (0x8A15_C00F, "WinGet configuration: configuration test failed"),
+    (0x8A15_C010, "WinGet configuration: configuration test was not run"),
+    (
+        0x8A15_C011,
+        "WinGet configuration: failed to get current configuration state",
+    ),
+    (0x8A15_C012, "WinGet configuration: history item was not found"),
+    (
+        0x8A15_C013,
+        "WinGet configuration: parameter crossed an integrity boundary",
+    ),
+    (0x8A15_C101, "WinGet configuration unit: unit is not installed"),
+    (
+        0x8A15_C102,
+        "WinGet configuration unit: unit was not found in the repository",
+    ),
+    (0x8A15_C103, "WinGet configuration unit: multiple units matched"),
+    (0x8A15_C104, "WinGet configuration unit: failed to read current state"),
+    (0x8A15_C105, "WinGet configuration unit: test operation failed"),
+    (0x8A15_C106, "WinGet configuration unit: apply operation failed"),
+    (0x8A15_C107, "WinGet configuration unit: module conflict"),
+    (0x8A15_C108, "WinGet configuration unit: failed to import module"),
+    (
+        0x8A15_C109,
+        "WinGet configuration unit: operation returned an invalid result",
+    ),
+    (
+        0x8A15_C110,
+        "WinGet configuration unit: failed to set configuration root",
+    ),
+    (
+        0x8A15_C111,
+        "WinGet configuration unit: module import requires administrator privileges",
+    ),
+    (0x8A15_C112, "WinGet configuration: processor is not supported"),
+    (0x8A15_C113, "WinGet configuration: processor hash mismatch"),
+];
+
+/// Map a known WinGet or Windows Installer exit code to a short, human-readable
+/// description, if recognized.
+///
+/// WinGet returns documented `HRESULT`-style codes in the `0x8A15_xxxx` and
+/// `0x0A15_xxxx` ranges. Common MSI / Windows Installer codes are also
+/// recognized. Returns `None` for codes that are not in the known set, so callers
+/// can fall back to reporting the raw numeric code.
+#[allow(clippy::cast_sign_loss)]
+pub fn describe_exit_code(exit_code: i32) -> Option<String> {
+    let code = exit_code as u32;
+    if let Some((_, message)) = WINGET_EXIT_CODE_MESSAGES
+        .iter()
+        .find(|(known_code, _)| *known_code == code)
+    {
+        return Some((*message).to_owned());
+    }
+
+    let description = match code {
+        // MSI / Windows Installer.
+        1602 => "Windows Installer: the user cancelled the installation",
+        1603 => "Windows Installer: a fatal error occurred during installation",
+        1605 => "Windows Installer: the action is only valid for an installed product",
+        1618 => "Windows Installer: another installation is already in progress",
+        1619 => "Windows Installer: the installation package could not be opened",
+        1620 => "Windows Installer: the installation package is invalid",
+        1638 => "Windows Installer: another version of this product is already installed",
+        1641 => "Windows Installer: a reboot was initiated to complete the installation",
+        3010 => "Windows Installer: a reboot is required to complete the operation",
+        _ => return None,
+    };
+    Some(description.to_owned())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn tail_utf8_keeps_short_output_verbatim() {
+        let s = "hello world";
+        assert_eq!(tail_utf8(s.as_bytes()), s);
+    }
+
+    #[test]
+    fn tail_utf8_truncates_to_tail_with_marker() {
+        let big = vec![b'a'; MAX_CAPTURED_OUTPUT_BYTES + 5000];
+        let out = tail_utf8(&big);
+        assert!(out.starts_with("[... output truncated"));
+        // The retained tail is exactly MAX_CAPTURED_OUTPUT_BYTES of 'a's.
+        assert!(out.ends_with(&"a".repeat(MAX_CAPTURED_OUTPUT_BYTES)));
+        assert!(!out.ends_with(&"a".repeat(MAX_CAPTURED_OUTPUT_BYTES + 1)));
+    }
+
+    #[test]
+    fn tail_utf8_handles_invalid_utf8_lossily() {
+        let bytes = [0xff, 0xfe, b'h', b'i'];
+        let out = tail_utf8(&bytes);
+        assert!(out.ends_with("hi"));
+    }
+
+    #[test]
+    fn describe_exit_code_recognizes_winget_cli_error() {
+        // 0x8A150014 = APPINSTALLER_CLI_ERROR_NO_APPLICATIONS_FOUND.
+        assert_eq!(
+            describe_exit_code(signed_hresult(0x8A15_0014)).as_deref(),
+            Some("WinGet: no package matched the query")
+        );
+    }
+
+    #[test]
+    fn describe_exit_code_recognizes_signed_winget_hresult() {
+        assert_eq!(
+            describe_exit_code(-1_978_335_216).as_deref(),
+            Some("WinGet: no applicable installer found")
+        );
+    }
+
+    #[test]
+    fn describe_exit_code_recognizes_winget_installer_error() {
+        assert_eq!(
+            describe_exit_code(signed_hresult(0x8A15_0109)).as_deref(),
+            Some("WinGet installer: reboot required to finish installation")
+        );
+    }
+
+    #[test]
+    fn describe_exit_code_recognizes_winget_config_error() {
+        assert_eq!(
+            describe_exit_code(signed_hresult(0x8A15_C001)).as_deref(),
+            Some("WinGet configuration: configuration file is invalid")
+        );
+    }
+
+    #[test]
+    fn describe_exit_code_recognizes_winget_config_test_failure() {
+        assert_eq!(
+            describe_exit_code(signed_hresult(0x8A15_C00F)).as_deref(),
+            Some("WinGet configuration: configuration test failed")
+        );
+    }
+
+    #[test]
+    fn describe_exit_code_recognizes_winget_config_unit_error() {
+        assert_eq!(
+            describe_exit_code(signed_hresult(0x8A15_C104)).as_deref(),
+            Some("WinGet configuration unit: failed to read current state")
+        );
+    }
+
+    #[test]
+    fn describe_exit_code_recognizes_winget_config_processor_error() {
+        assert_eq!(
+            describe_exit_code(signed_hresult(0x8A15_C112)).as_deref(),
+            Some("WinGet configuration: processor is not supported")
+        );
+    }
+
+    #[test]
+    fn describe_exit_code_recognizes_winget_installed_status() {
+        assert_eq!(
+            describe_exit_code(signed_hresult(0x0A15_0206)).as_deref(),
+            Some("WinGet installed status: file found but hash was not checked")
+        );
+    }
+
+    #[test]
+    fn describe_exit_code_recognizes_msi_reboot_required() {
+        assert_eq!(
+            describe_exit_code(3010).as_deref(),
+            Some("Windows Installer: a reboot is required to complete the operation")
+        );
+    }
+
+    #[test]
+    fn describe_exit_code_returns_none_for_unknown() {
+        assert_eq!(describe_exit_code(1), None);
+        assert_eq!(describe_exit_code(0), None);
+    }
+
+    fn signed_hresult(code: u32) -> i32 {
+        i32::from_ne_bytes(code.to_ne_bytes())
+    }
+}
diff --git a/devolutions-agent/src/broker/executor/windows/mod.rs b/devolutions-agent/src/broker/executor/windows/mod.rs
new file mode 100644
index 000000000..ee42c8bb3
--- /dev/null
+++ b/devolutions-agent/src/broker/executor/windows/mod.rs
@@ -0,0 +1,255 @@
+//! Windows command executor.
+//!
+//! Uses a unified `CreateProcessAsUserW` code path for both SYSTEM (service) and
+//! current-user (development) modes.
+
+use anyhow::{Context as _, bail};
+use async_trait::async_trait;
+use now_policy_api::{Elevation, Scope};
+use win_api_wrappers::process::Process;
+use win_api_wrappers::security::privilege::{self, ScopedPrivileges};
+use win_api_wrappers::token::Token;
+use windows::Win32::Security::{TOKEN_ADJUST_PRIVILEGES, TOKEN_ALL_ACCESS, TOKEN_QUERY};
+
+use super::{CommandExecutor, ExecutionContext, ExecutionOutput};
+
+mod process;
+mod token;
+
+use process::create_process;
+use token::{detect_running_as_system, find_user_session, get_elevated_token};
+
+/// Windows command executor using `win-api-wrappers` safe abstractions.
+///
+/// Detects whether it runs as SYSTEM (service mode) or as a normal user (dev mode).
+/// Both modes use a unified `create_process_as_user` code path.
+pub struct WindowsExecutor {
+    is_system: bool,
+}
+
+impl Default for WindowsExecutor {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+impl WindowsExecutor {
+    pub fn new() -> Self {
+        let is_system = detect_running_as_system();
+        if is_system {
+            tracing::info!("Executor initialized in SYSTEM (service) mode");
+        } else {
+            tracing::info!("Executor initialized in user (development) mode");
+        }
+        Self { is_system }
+    }
+}
+
+#[async_trait]
+impl CommandExecutor for WindowsExecutor {
+    async fn execute(&self, ctx: &ExecutionContext) -> anyhow::Result<ExecutionOutput> {
+        let requires_elevation = ctx.elevation == Elevation::Elevated || ctx.scope == Some(Scope::Machine);
+
+        if !self.is_system && requires_elevation {
+            bail!(
+                "elevated execution requested but broker is not running as SYSTEM; \
+                 elevation is only supported in service mode"
+            );
+        }
+
+        let is_system = self.is_system;
+        let ctx = ctx.clone();
+
+        // All Win32 calls are blocking — run in a blocking thread.
+        tokio::task::spawn_blocking(move || {
+            if is_system {
+                execute_as_system(&ctx)
+            } else {
+                execute_as_current_user(&ctx)
+            }
+        })
+        .await
+        .context("blocking task panicked")?
+    }
+}
+
+/// Execute a command in the context of the target user's session (SYSTEM mode).
+///
+/// Steps:
+/// 1. Find the user's active session via WTS enumeration.
+/// 2. Get the session token.
+/// 3. If elevated execution is requested, obtain the linked elevated token.
+/// 4. Set the token session ID and create the process.
+/// 5. Wait for the process to exit and return the exit code.
+fn execute_as_system(ctx: &ExecutionContext) -> anyhow::Result<ExecutionOutput> {
+    let requires_elevation = ctx.elevation == Elevation::Elevated || ctx.scope == Some(Scope::Machine);
+
+    tracing::info!(
+        effective_user = %ctx.effective_user,
+        command = %ctx.command.join(" "),
+        requires_elevation,
+        "Starting SYSTEM-mode execution"
+    );
+
+    // Enable privileges required by CreateProcessAsUserW when running as SYSTEM.
+    // These are held by SYSTEM but not enabled by default.
+    let mut process_token = Process::current_process()
+        .token(TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY)
+        .context("failed to open process token for privilege adjustment")?;
+
+    tracing::debug!("Enabling SeTcb privilege");
+    let mut _priv_tcb =
+        ScopedPrivileges::enter(&mut process_token, &[privilege::SE_TCB_NAME]).context("failed to enable SeTcb")?;
+
+    tracing::debug!("Enabling SeAssignPrimaryToken privilege");
+    let mut _priv_primary = ScopedPrivileges::enter(_priv_tcb.token_mut(), &[privilege::SE_ASSIGNPRIMARYTOKEN_NAME])
+        .context("failed to enable SeAssignPrimaryToken")?;
+
+    tracing::debug!("Enabling SeIncreaseQuota privilege");
+    let _priv_quota = ScopedPrivileges::enter(_priv_primary.token_mut(), &[privilege::SE_INCREASE_QUOTA_NAME])
+        .context("failed to enable SeIncreaseQuota")?;
+
+    tracing::debug!("All privileges enabled, finding user session");
+
+    let session_id = find_user_session(&ctx.effective_user).context("failed to find active session for user")?;
+
+    tracing::info!(
+        effective_user = %ctx.effective_user,
+        session_id,
+        "Found user session"
+    );
+
+    tracing::debug!(session_id, "Calling Token::for_session");
+    let user_token = Token::for_session(session_id).context("failed to obtain user token for session")?;
+
+    tracing::debug!("Duplicating user token as primary");
+    let primary_token = token::duplicate_as_primary(&user_token).context("failed to duplicate token as primary")?;
+
+    let mut execution_token = if requires_elevation {
+        tracing::debug!("Attempting to get elevated token");
+        match get_elevated_token(&primary_token) {
+            Ok(elevated) => {
+                tracing::info!("Using elevated (linked) token");
+                elevated
+            }
+            Err(error) => {
+                tracing::warn!(%error, "Could not obtain elevated token, using primary");
+                primary_token
+            }
+        }
+    } else {
+        tracing::debug!("Using non-elevated primary token");
+        primary_token
+    };
+
+    // Assign the target session to the token before process creation.
+    tracing::debug!(session_id, "Setting token session ID");
+    execution_token
+        .set_session_id(session_id)
+        .context("failed to set token session ID")?;
+
+    tracing::info!(
+        command = %ctx.command.join(" "),
+        session_id,
+        "Running execution plan"
+    );
+
+    let output = run_plan(&execution_token, ctx, session_id)?;
+
+    tracing::info!(
+        effective_user = %ctx.effective_user,
+        command = %ctx.command.join(" "),
+        exit_code = output.exit_code,
+        "Plan completed under user token"
+    );
+
+    Ok(output)
+}
+
+/// Execute a command as the current user (development mode).
+///
+/// Opens the current process token and uses the same `create_process_as_user`
+/// code path as SYSTEM mode, ensuring consistent behavior (environment, desktop, flags).
+fn execute_as_current_user(ctx: &ExecutionContext) -> anyhow::Result<ExecutionOutput> {
+    tracing::info!(
+        effective_user = %ctx.effective_user,
+        command = %ctx.command.join(" "),
+        "Executing command as current user (dev mode)"
+    );
+
+    let token = Process::current_process()
+        .token(TOKEN_ALL_ACCESS)
+        .context("failed to open current process token")?;
+
+    let session_id = token.session_id().context("failed to query token session ID")?;
+
+    let output = run_plan(&token, ctx, session_id)?;
+
+    tracing::info!(
+        command = %ctx.command.join(" "),
+        exit_code = output.exit_code,
+        "Plan completed under current user token"
+    );
+
+    Ok(output)
+}
+
+/// Run the full execution plan under `token`: best-effort process kills, an
+/// optional pre-operation command (must succeed), the main package-manager
+/// command, then an optional post-operation command (failures are logged).
+///
+/// Returns the exit code and captured output of the main command.
+fn run_plan(token: &Token, ctx: &ExecutionContext, session_id: u32) -> anyhow::Result<ExecutionOutput> {
+    // 1. Kill requested processes (best-effort; a missing process is not an error).
+    for process_name in &ctx.kill_processes {
+        let kill_cmd = vec![
+            "taskkill.exe".to_owned(),
+            "/F".to_owned(),
+            "/IM".to_owned(),
+            process_name.clone(),
+        ];
+        match create_process(token, &kill_cmd, session_id, false) {
+            Ok(out) => tracing::info!(%process_name, exit_code = out.exit_code, "Kill-before-operation completed"),
+            Err(error) => tracing::warn!(%process_name, %error, "Kill-before-operation failed (ignored)"),
+        }
+    }
+
+    // 2. Pre-operation command — must succeed before the main operation runs.
+    if let Some(pre) = &ctx.pre_command {
+        tracing::info!(command = %pre, "Running pre-operation command");
+        let out = create_process(token, &shell_command(pre), session_id, ctx.capture_output)
+            .context("failed to run pre-operation command")?;
+        if out.exit_code != 0 {
+            bail!(
+                "pre-operation command exited with code {}: {}",
+                out.exit_code,
+                out.stdout.trim()
+            );
+        }
+    }
+
+    // 3. Main package-manager command.
+    let output = create_process(token, &ctx.command, session_id, ctx.capture_output)?;
+
+    // 4. Post-operation command — runs after the main command; failures are logged only.
+    if let Some(post) = &ctx.post_command {
+        tracing::info!(command = %post, "Running post-operation command");
+        match create_process(token, &shell_command(post), session_id, false) {
+            Ok(out) if out.exit_code == 0 => {}
+            Ok(out) => tracing::warn!(exit_code = out.exit_code, "Post-operation command exited non-zero"),
+            Err(error) => tracing::warn!(%error, "Post-operation command failed"),
+        }
+    }
+
+    Ok(output)
+}
+
+/// Build a `cmd.exe` invocation for a client-supplied shell payload.
+///
+/// Mirrors package broker client pre/post command semantics: newlines are collapsed into
+/// `&` separators, and `/S /C` makes `cmd.exe` strip the outermost quotes and
+/// run the remainder verbatim, so the quoting added by `CommandLine` round-trips.
+fn shell_command(payload: &str) -> Vec<String> {
+    let normalized = payload.replace('\r', "\n").replace("\n\n", "\n").replace('\n', "&");
+    vec!["cmd.exe".to_owned(), "/S".to_owned(), "/C".to_owned(), normalized]
+}
diff --git a/devolutions-agent/src/broker/executor/windows/process.rs b/devolutions-agent/src/broker/executor/windows/process.rs
new file mode 100644
index 000000000..e39f8bba5
--- /dev/null
+++ b/devolutions-agent/src/broker/executor/windows/process.rs
@@ -0,0 +1,217 @@
+//! Process creation helpers for Windows execution.
+
+use std::io::Read as _;
+use std::path::{Path, PathBuf};
+
+use anyhow::{Context as _, bail};
+use win_api_wrappers::process::{self, StartupInfo};
+use win_api_wrappers::security::attributes::SecurityAttributesInit;
+use win_api_wrappers::token::Token;
+use win_api_wrappers::utils::{self, CommandLine, Pipe, WideString};
+use windows::Win32::System::Threading::{
+    CREATE_NEW_CONSOLE, NORMAL_PRIORITY_CLASS, STARTF_USESHOWWINDOW, STARTF_USESTDHANDLES,
+};
+use windows::Win32::UI::WindowsAndMessaging::SW_HIDE;
+
+use crate::broker::executor::{ExecutionOutput, tail_utf8};
+
+/// Create a process under the given token and wait for exit.
+///
+/// This is the unified process-creation path used by both SYSTEM and current-user modes.
+/// The process always runs with no visible window (`STARTF_USESHOWWINDOW` + `SW_HIDE`, the
+/// same approach `devolutions-session` uses). When `capture` is true, the child's
+/// stdout+stderr are redirected into a single pipe and returned (tail-truncated to
+/// [`crate::broker::executor::MAX_CAPTURED_OUTPUT_BYTES`]); otherwise no output is captured.
+///
+/// Returns the process exit code and (when captured) its output.
+#[allow(clippy::cast_possible_wrap)]
+pub(super) fn create_process(
+    token: &Token,
+    command: &[String],
+    session_id: u32,
+    capture: bool,
+) -> anyhow::Result<ExecutionOutput> {
+    let cmd_line = CommandLine::new(command.to_vec());
+
+    tracing::debug!(
+        command_line = %command.join(" "),
+        session_id,
+        capture,
+        "Building process creation parameters"
+    );
+
+    // Resolve the executable using the user's environment PATH.
+    // CreateProcessAsUserW searches the CALLING process's PATH (SYSTEM) to find the
+    // executable, not the child's environment block. Since tools like winget.exe live
+    // in per-user directories (e.g. %LOCALAPPDATA%\Microsoft\WindowsApps), we must
+    // resolve the full path ourselves using the user's environment.
+    let user_env = utils::environment_block(Some(token), false).context("failed to load user environment block")?;
+
+    let exe_name = command.first().context("empty command")?;
+    let resolved_exe = resolve_executable(exe_name, &user_env).with_context(|| {
+        format!(
+            "could not find '{}' in user's PATH: {:?}",
+            exe_name,
+            user_env.get("Path").or_else(|| user_env.get("PATH"))
+        )
+    })?;
+
+    tracing::info!(
+        exe = %resolved_exe.display(),
+        "Resolved executable path from user environment"
+    );
+
+    // The window is always hidden. `WinSta0\Default` keeps the process on the interactive
+    // desktop; `SW_HIDE` keeps any console it allocates invisible.
+    let mut startup_info = StartupInfo {
+        desktop: WideString::from("WinSta0\\Default"),
+        flags: STARTF_USESHOWWINDOW,
+        show_window: u16::try_from(SW_HIDE.0).expect("SW_HIDE fits into u16"),
+        ..Default::default()
+    };
+
+    // Capture pipes are only set up when requested. They must be kept alive through
+    // process creation, and the child's ends closed afterwards so the reader sees EOF.
+    let inheritable = SecurityAttributesInit {
+        inherit_handle: true,
+        ..Default::default()
+    }
+    .init();
+    let (output_read, held_output_write, held_stdin_read) = if capture {
+        let (out_read, out_write) =
+            Pipe::new_anonymous(Some(&inheritable), 0).context("failed to create output capture pipe")?;
+        // Empty stdin (write end closed immediately so the child reads EOF).
+        let (in_read, in_write) = Pipe::new_anonymous(Some(&inheritable), 0).context("failed to create stdin pipe")?;
+        drop(in_write);
+
+        startup_info.flags = STARTF_USESTDHANDLES | STARTF_USESHOWWINDOW;
+        startup_info.std_input = in_read.handle.raw();
+        startup_info.std_output = out_write.handle.raw();
+        startup_info.std_error = out_write.handle.raw();
+
+        (Some(out_read), Some(out_write), Some(in_read))
+    } else {
+        (None, None, None)
+    };
+
+    let creation_flags = CREATE_NEW_CONSOLE | NORMAL_PRIORITY_CLASS;
+
+    tracing::debug!("Calling process::create_process_as_user");
+
+    let process_info = match process::create_process_as_user(
+        Some(token),
+        Some(&resolved_exe),
+        Some(&cmd_line),
+        None,
+        None,
+        // Inherit handles only when capturing (so the child receives the pipe ends).
+        capture,
+        creation_flags,
+        Some(&user_env),
+        None,
+        &mut startup_info,
+    ) {
+        Ok(info) => info,
+        Err(error) => {
+            tracing::error!(
+                error = format!("{error:#}"),
+                command_line = %command.join(" "),
+                exe = %resolved_exe.display(),
+                session_id,
+                "create_process_as_user failed"
+            );
+            return Err(error).with_context(|| {
+                format!(
+                    "CreateProcessAsUserW failed for '{}' (session {})",
+                    resolved_exe.display(),
+                    session_id
+                )
+            });
+        }
+    };
+
+    // Close our copies of the child's handles so the read end observes EOF on exit.
+    drop(held_output_write);
+    drop(held_stdin_read);
+
+    tracing::info!(
+        session_id,
+        pid = process_info.process_id,
+        capture,
+        "Process spawned, waiting for exit"
+    );
+
+    // Drain the pipe on a separate thread so a child producing more output than the pipe
+    // buffer can hold does not deadlock against our wait-for-exit.
+    let reader = output_read.map(|mut pipe| {
+        std::thread::spawn(move || {
+            let mut buffer = Vec::new();
+            let _ = pipe.read_to_end(&mut buffer);
+            buffer
+        })
+    });
+
+    // Wait for the process to exit (no timeout; the server enforces an overall timeout).
+    process_info.process.wait(None).context("failed to wait for process")?;
+
+    let exit_code = process_info
+        .process
+        .exit_code()
+        .context("failed to get process exit code")?;
+
+    let stdout = match reader {
+        Some(handle) => tail_utf8(&handle.join().unwrap_or_default()),
+        None => String::new(),
+    };
+
+    Ok(ExecutionOutput {
+        exit_code: exit_code as i32,
+        stdout,
+    })
+}
+
+/// Resolve an executable name to its full path using the given environment's PATH.
+///
+/// Handles both absolute paths and bare names (e.g., `winget.exe`).
+/// Appends `.exe` if no extension is present and the file is not found as-is.
+fn resolve_executable(exe_name: &str, env: &std::collections::HashMap<String, String>) -> anyhow::Result<PathBuf> {
+    let exe_path = Path::new(exe_name);
+
+    // If already an absolute path, just verify it exists.
+    if exe_path.is_absolute() {
+        if exe_path.exists() {
+            return Ok(exe_path.to_owned());
+        }
+        bail!("executable not found at absolute path: {}", exe_path.display());
+    }
+
+    // Get PATH from environment (case-insensitive key lookup).
+    let path_var = env
+        .iter()
+        .find(|(k, _)| k.eq_ignore_ascii_case("PATH"))
+        .map(|(_, v)| v.as_str())
+        .unwrap_or_default();
+
+    let extensions: &[&str] = if exe_path.extension().is_some() {
+        &[""]
+    } else {
+        &["", ".exe", ".cmd", ".bat", ".com"]
+    };
+
+    for dir in path_var.split(';') {
+        let dir = dir.trim();
+        if dir.is_empty() {
+            continue;
+        }
+        for ext in extensions {
+            let mut candidate = PathBuf::from(dir);
+            let file_name = format!("{}{}", exe_name, ext);
+            candidate.push(&file_name);
+            if candidate.exists() {
+                return Ok(candidate);
+            }
+        }
+    }
+
+    bail!("executable '{}' not found in PATH", exe_name);
+}
diff --git a/devolutions-agent/src/broker/executor/windows/token.rs b/devolutions-agent/src/broker/executor/windows/token.rs
new file mode 100644
index 000000000..1202c6d89
--- /dev/null
+++ b/devolutions-agent/src/broker/executor/windows/token.rs
@@ -0,0 +1,81 @@
+//! Token and session helpers for Windows execution.
+
+use anyhow::{Context as _, bail};
+use win_api_wrappers::identity::sid::Sid;
+use win_api_wrappers::process::Process;
+use win_api_wrappers::token::{Token, TokenElevationType};
+use win_api_wrappers::wts;
+use windows::Win32::Security::{SecurityImpersonation, TOKEN_ALL_ACCESS, TOKEN_QUERY, TokenPrimary};
+
+/// Detect whether the current process is running under the SYSTEM account.
+///
+/// Compares the process token SID against S-1-5-18 (LocalSystem).
+pub(super) fn detect_running_as_system() -> bool {
+    let Ok(token) = Process::current_process().token(TOKEN_QUERY) else {
+        return false;
+    };
+
+    let Ok(sid_and_attrs) = token.sid_and_attributes() else {
+        return false;
+    };
+
+    let Ok(system_sid) = Sid::from_well_known(windows::Win32::Security::WinLocalSystemSid, None) else {
+        return false;
+    };
+
+    sid_and_attrs.sid == system_sid
+}
+
+pub(super) fn duplicate_as_primary(token: &Token) -> anyhow::Result<Token> {
+    token.duplicate(TOKEN_ALL_ACCESS, None, SecurityImpersonation, TokenPrimary)
+}
+
+/// Enumerate WTS sessions to find one belonging to `effective_user`.
+///
+/// `effective_user` can be `DOMAIN\user` or just `user`.
+pub(super) fn find_user_session(effective_user: &str) -> anyhow::Result<u32> {
+    let target_username = effective_user
+        .rsplit('\\')
+        .next()
+        .unwrap_or(effective_user)
+        .to_lowercase();
+
+    let sessions = wts::get_sessions().context("failed to enumerate WTS sessions")?;
+
+    for session in &sessions {
+        if session.session_id == 0 {
+            continue;
+        }
+
+        if let Ok(session_user) = wts::get_session_user_name(session.session_id)
+            && session_user.to_lowercase() == target_username
+        {
+            return Ok(session.session_id);
+        }
+    }
+
+    anyhow::bail!("no active session found for user '{effective_user}'")
+}
+
+/// Attempt to obtain an elevated (linked) token from a filtered/limited token.
+///
+/// On UAC-enabled systems with split tokens, the standard user token has a linked
+/// elevated token. This function retrieves it when elevation is requested.
+pub(super) fn get_elevated_token(token: &Token) -> anyhow::Result<Token> {
+    let elevation_type = token.elevation_type().context("failed to query elevation type")?;
+
+    match elevation_type {
+        TokenElevationType::Full => {
+            // Already elevated — duplicate as primary.
+            duplicate_as_primary(token).context("failed to duplicate full token")
+        }
+        TokenElevationType::Limited => {
+            // Obtain the linked (elevated) token and duplicate as primary.
+            let linked = token.linked_token().context("failed to get linked token")?;
+            duplicate_as_primary(&linked).context("failed to duplicate linked token")
+        }
+        TokenElevationType::Default => {
+            bail!("token elevation type is Default; cannot elevate (UAC may be disabled)");
+        }
+    }
+}
diff --git a/devolutions-agent/src/broker/mod.rs b/devolutions-agent/src/broker/mod.rs
new file mode 100644
index 000000000..8c8e00f43
--- /dev/null
+++ b/devolutions-agent/src/broker/mod.rs
@@ -0,0 +1,18 @@
+//! Package broker module.
+//!
+//! Provides policy evaluation and command execution for package operations,
+//! communicating over a Windows named pipe using HTTP/1.1.
+
+pub(crate) mod auth;
+pub mod command_builder;
+pub mod evaluator;
+pub mod executor;
+pub mod operation_tracker;
+pub mod pipe;
+pub mod policy_loader;
+pub mod policy_watcher;
+pub mod server;
+pub mod task;
+
+#[cfg(test)]
+mod scenario_tests;
diff --git a/devolutions-agent/src/broker/operation_tracker.rs b/devolutions-agent/src/broker/operation_tracker.rs
new file mode 100644
index 000000000..e00bc1faf
--- /dev/null
+++ b/devolutions-agent/src/broker/operation_tracker.rs
@@ -0,0 +1,177 @@
+//! Operation tracker — tracks in-flight and recently completed operations.
+//!
+//! Each tracked operation holds the current status and is updated by a background
+//! task that waits for the process to exit. Completed operations are retained for
+//! a configurable retention period before being evicted.
+
+use std::collections::HashMap;
+use std::sync::{Arc, Mutex};
+use std::time::Duration;
+
+use chrono::{DateTime, Utc};
+use now_policy_api::{OperationStatus, ResourceId};
+use tokio::sync::Notify;
+
+/// How long completed/failed operation results are retained for status queries.
+const RESULT_RETENTION: Duration = Duration::from_secs(5 * 60); // 5 minutes.
+
+/// Maximum operation runtime before declaring timeout.
+const OPERATION_TIMEOUT: Duration = Duration::from_secs(60 * 60); // 1 hour.
+
+/// Internal state of a tracked operation.
+#[derive(Debug, Clone)]
+pub struct TrackedOperation {
+    /// Original request identifier.
+    pub request_id: ResourceId,
+    /// Current status.
+    pub status: OperationStatus,
+    /// When the process was launched (Some after CreateProcess succeeds).
+    pub started_at: Option<DateTime<Utc>>,
+    /// When the operation completed/failed.
+    pub completed_at: Option<DateTime<Utc>>,
+    /// Process exit code (when available).
+    pub exit_code: Option<i32>,
+    /// Human-readable note.
+    pub note: Option<String>,
+    /// Captured combined stdout+stderr (tail-truncated), when the request opted in.
+    pub stdout: Option<String>,
+    /// When this entry should be evicted (set upon completion/failure).
+    pub expires_at: Option<DateTime<Utc>>,
+}
+
+/// Thread-safe operation tracker.
+#[derive(Clone)]
+pub struct OperationTracker {
+    state: Arc<Mutex<TrackerState>>,
+}
+
+struct TrackerState {
+    operations: HashMap<String, TrackedOperation>,
+    request_index: HashMap<String, String>,
+}
+
+impl Default for OperationTracker {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+impl OperationTracker {
+    pub fn new() -> Self {
+        Self {
+            state: Arc::new(Mutex::new(TrackerState {
+                operations: HashMap::new(),
+                request_index: HashMap::new(),
+            })),
+        }
+    }
+
+    /// Register a new operation as Starting.
+    ///
+    /// Returns the operation ID and whether this call created a new operation.
+    pub fn register(&self, request_id: &ResourceId, operation_id: ResourceId) -> (ResourceId, bool) {
+        let mut state = self.state.lock().expect("tracker lock poisoned");
+        let request_key = request_id.to_string();
+        if let Some(existing_operation_id) = state.request_index.get(&request_key) {
+            return (ResourceId::from(existing_operation_id.as_str()), false);
+        }
+
+        let operation_key = operation_id.to_string();
+        state.request_index.insert(request_key, operation_key.clone());
+        state.operations.insert(
+            operation_key,
+            TrackedOperation {
+                request_id: request_id.clone(),
+                status: OperationStatus::Starting,
+                started_at: None,
+                completed_at: None,
+                exit_code: None,
+                note: None,
+                stdout: None,
+                expires_at: None,
+            },
+        );
+        (operation_id, true)
+    }
+
+    /// Mark an operation as Running (process launched).
+    pub fn mark_running(&self, request_id: &str) {
+        let mut state = self.state.lock().expect("tracker lock poisoned");
+        if let Some(op) = state.operations.get_mut(request_id) {
+            op.status = OperationStatus::Running;
+            op.started_at = Some(Utc::now());
+        }
+    }
+
+    /// Mark an operation as finished with an exit code, a status note (success message or
+    /// short error summary), and optionally captured output.
+    pub fn mark_completed(&self, request_id: &str, exit_code: i32, note: String, stdout: Option<String>) {
+        let mut state = self.state.lock().expect("tracker lock poisoned");
+        if let Some(op) = state.operations.get_mut(request_id) {
+            let now = Utc::now();
+            op.status = if exit_code == 0 {
+                OperationStatus::Completed
+            } else {
+                OperationStatus::Failed
+            };
+            op.exit_code = Some(exit_code);
+            op.note = Some(note);
+            op.stdout = stdout;
+            op.completed_at = Some(now);
+            op.expires_at = Some(now + chrono::Duration::from_std(RESULT_RETENTION).expect("valid duration"));
+        }
+    }
+
+    /// Mark an operation as Failed without a process exit code (launch failure or timeout).
+    pub fn mark_failed(&self, request_id: &str, note: String, stdout: Option<String>) {
+        let mut state = self.state.lock().expect("tracker lock poisoned");
+        if let Some(op) = state.operations.get_mut(request_id) {
+            let now = Utc::now();
+            op.status = OperationStatus::Failed;
+            op.note = Some(note);
+            op.stdout = stdout;
+            op.completed_at = Some(now);
+            op.expires_at = Some(now + chrono::Duration::from_std(RESULT_RETENTION).expect("valid duration"));
+        }
+    }
+
+    /// Query the current state of an operation.
+    pub fn get(&self, request_id: &str) -> Option<TrackedOperation> {
+        let state = self.state.lock().expect("tracker lock poisoned");
+        state.operations.get(request_id).cloned()
+    }
+
+    /// Remove expired entries. Called periodically.
+    pub fn evict_expired(&self) {
+        let now = Utc::now();
+        let mut state = self.state.lock().expect("tracker lock poisoned");
+        state.operations.retain(|_, op| match op.expires_at {
+            Some(expiry) => now < expiry,
+            None => true, // Still running, keep it.
+        });
+        let retained_operation_ids: std::collections::HashSet<_> = state.operations.keys().cloned().collect();
+        state
+            .request_index
+            .retain(|_, operation_id| retained_operation_ids.contains(operation_id));
+    }
+
+    /// Returns the operation timeout duration.
+    pub fn operation_timeout() -> Duration {
+        OPERATION_TIMEOUT
+    }
+
+    /// Spawn a background task that periodically evicts expired operations.
+    pub fn spawn_eviction_task(self, shutdown: Arc<Notify>) {
+        tokio::spawn(async move {
+            let interval = Duration::from_secs(30);
+            loop {
+                tokio::select! {
+                    _ = shutdown.notified() => break,
+                    _ = tokio::time::sleep(interval) => {
+                        self.evict_expired();
+                    }
+                }
+            }
+        });
+    }
+}
diff --git a/devolutions-agent/src/broker/pipe.rs b/devolutions-agent/src/broker/pipe.rs
new file mode 100644
index 000000000..1c4b12282
--- /dev/null
+++ b/devolutions-agent/src/broker/pipe.rs
@@ -0,0 +1,148 @@
+//! Named pipe transport for Windows.
+//!
+//! Creates a named pipe server with appropriate ACLs and accepts connections,
+//! forwarding them to the HTTP server.
+
+#[cfg(windows)]
+mod windows_pipe {
+    use std::sync::Arc;
+
+    use anyhow::Context as _;
+    use tokio::net::windows::named_pipe::{NamedPipeServer, ServerOptions};
+    use tokio::sync::Notify;
+    use win_api_wrappers::identity::sid::Sid;
+    use win_api_wrappers::security::acl::{Acl, ExplicitAccess, InheritableAcl, InheritableAclKind, Trustee};
+    use win_api_wrappers::security::attributes::SecurityAttributesInit;
+    use windows::Win32::Foundation::GENERIC_ALL;
+    use windows::Win32::Security;
+    use windows::Win32::Security::Authorization::SET_ACCESS;
+    use windows::Win32::Storage::FileSystem::{FILE_GENERIC_READ, FILE_GENERIC_WRITE};
+
+    use crate::broker::auth::PipeClient;
+    use crate::broker::server::{BrokerState, build_router_for_client, serve_connection};
+
+    /// Default pipe name for the package broker.
+    pub const DEFAULT_PIPE_NAME: &str = r"\\.\pipe\Devolutions.Now.PackageBroker.v1";
+
+    /// Start the named pipe server and accept connections until shutdown.
+    pub async fn run_pipe_server(state: Arc<BrokerState>, shutdown: Arc<Notify>) -> anyhow::Result<()> {
+        let pipe_name = state.pipe_name.clone();
+        tracing::info!(%pipe_name, "Starting named pipe server");
+
+        loop {
+            // Create a new pipe instance for each connection.
+            let server = create_pipe_instance(&pipe_name)?;
+
+            tokio::select! {
+                result = server.connect() => {
+                    match result {
+                        Ok(()) => {
+                            let client = match PipeClient::from_connected_pipe(&server) {
+                                Ok(client) => client,
+                                Err(error) => {
+                                    tracing::warn!(%error, "Rejected named pipe client");
+                                    continue;
+                                }
+                            };
+                            tracing::info!("Client connected to named pipe");
+                            let router = build_router_for_client(Arc::clone(&state), client);
+                            tokio::spawn(async move {
+                                serve_connection(server, router).await;
+                                tracing::info!("Client disconnected from named pipe");
+                            });
+                        }
+                        Err(error) => {
+                            tracing::error!(%error, "Failed to accept pipe connection");
+                        }
+                    }
+                }
+                _ = shutdown.notified() => {
+                    tracing::info!("Pipe server shutting down");
+                    return Ok(());
+                }
+            }
+        }
+    }
+
+    fn create_pipe_instance(pipe_name: &str) -> anyhow::Result<NamedPipeServer> {
+        let security_attributes =
+            build_pipe_security_attributes().context("failed to build pipe security attributes")?;
+
+        // SAFETY: `create_with_security_attributes_raw` requires a pointer to a valid
+        // `SECURITY_ATTRIBUTES` that stays alive for the duration of the call. The pointer
+        // comes from `security_attributes` (a `win_api_wrappers::security::SecurityAttributes`),
+        // a local binding that owns the structure and its security descriptor and is dropped
+        // only at the end of this function, well after the call returns. `CreateNamedPipeW`
+        // copies the descriptor at creation, so the pointer is not retained afterwards.
+        let server = unsafe {
+            ServerOptions::new()
+                .first_pipe_instance(false)
+                .create_with_security_attributes_raw(pipe_name, security_attributes.as_mut_ptr().cast())
+        }?;
+
+        Ok(server)
+    }
+
+    /// Build a security descriptor that grants:
+    /// - SYSTEM: full control
+    /// - Administrators: full control
+    /// - BUILTIN\Users: read + write (allows interactive users to connect)
+    fn build_pipe_security_attributes() -> anyhow::Result<win_api_wrappers::security::attributes::SecurityAttributes> {
+        let system_sid =
+            Sid::from_well_known(Security::WinLocalSystemSid, None).context("failed to create SYSTEM SID")?;
+        let admins_sid = Sid::from_well_known(Security::WinBuiltinAdministratorsSid, None)
+            .context("failed to create Administrators SID")?;
+        let users_sid =
+            Sid::from_well_known(Security::WinBuiltinUsersSid, None).context("failed to create Users SID")?;
+
+        let entries = [
+            ExplicitAccess {
+                access_permissions: GENERIC_ALL.0,
+                access_mode: SET_ACCESS,
+                inheritance: Security::ACE_FLAGS(0),
+                trustee: Trustee::Sid(system_sid),
+            },
+            ExplicitAccess {
+                access_permissions: GENERIC_ALL.0,
+                access_mode: SET_ACCESS,
+                inheritance: Security::ACE_FLAGS(0),
+                trustee: Trustee::Sid(admins_sid),
+            },
+            ExplicitAccess {
+                access_permissions: FILE_GENERIC_READ.0 | FILE_GENERIC_WRITE.0,
+                access_mode: SET_ACCESS,
+                inheritance: Security::ACE_FLAGS(0),
+                trustee: Trustee::Sid(users_sid),
+            },
+        ];
+
+        let empty_acl = Acl::new().context("failed to create empty ACL")?;
+        let dacl = empty_acl.set_entries(&entries).context("failed to set ACL entries")?;
+
+        let attrs = SecurityAttributesInit {
+            dacl: Some(InheritableAcl {
+                kind: InheritableAclKind::Protected,
+                acl: dacl,
+            }),
+            ..Default::default()
+        }
+        .init();
+
+        Ok(attrs)
+    }
+}
+
+#[cfg(windows)]
+pub use windows_pipe::*;
+
+/// Fallback for non-Windows (pipe transport not supported).
+#[cfg(not(windows))]
+pub const DEFAULT_PIPE_NAME: &str = "not-supported-on-this-platform";
+
+#[cfg(not(windows))]
+pub async fn run_pipe_server(
+    _state: std::sync::Arc<crate::broker::server::BrokerState>,
+    _shutdown: std::sync::Arc<tokio::sync::Notify>,
+) -> anyhow::Result<()> {
+    anyhow::bail!("named pipe transport is only supported on Windows")
+}
diff --git a/devolutions-agent/src/broker/policy_loader.rs b/devolutions-agent/src/broker/policy_loader.rs
new file mode 100644
index 000000000..beac970d8
--- /dev/null
+++ b/devolutions-agent/src/broker/policy_loader.rs
@@ -0,0 +1,84 @@
+//! Policy file loader.
+//!
+//! Loads policy documents from the configured directory.
+//! Supports both JSON (`.json`) and YAML (`.yaml`, `.yml`) formats.
+//! Default location: `%PROGRAMDATA%/Devolutions/Agent/`
+
+use std::path::{Path, PathBuf};
+
+use now_policy::PolicyDocument;
+use now_policy::schema::{parse_policy_json, parse_policy_yaml};
+
+/// Default policy directory.
+pub fn default_policy_dir() -> PathBuf {
+    if cfg!(windows) {
+        let program_data = std::env::var("PROGRAMDATA").unwrap_or_else(|_| r"C:\ProgramData".to_owned());
+        PathBuf::from(program_data).join("Devolutions").join("Agent")
+    } else {
+        PathBuf::from("/etc/devolutions-agent")
+    }
+}
+
+/// Base name for the policy file (without extension).
+const POLICY_FILE_BASE: &str = "package-broker-policy";
+
+/// Supported policy file extensions in priority order.
+const POLICY_EXTENSIONS: &[&str] = &["json", "yaml", "yml"];
+
+/// Load a policy document from a file path.
+///
+/// The file format is detected from the extension:
+/// - `.json` — parsed as JSON
+/// - `.yaml` or `.yml` — parsed as YAML
+///
+/// Deserialization performs all validation (structure, types, length constraints, patterns).
+pub fn load_policy(path: &Path) -> anyhow::Result<PolicyDocument> {
+    let content = std::fs::read_to_string(path)
+        .map_err(|e| anyhow::anyhow!("failed to read policy file at {}: {e}", path.display()))?;
+
+    let policy = deserialize_policy(&content, path)?;
+
+    tracing::info!(
+        policy_id = %policy.metadata.id,
+        revision = policy.metadata.revision,
+        rules_count = policy.rules.len(),
+        "Loaded policy"
+    );
+
+    Ok(policy)
+}
+
+/// Deserialize policy content, detecting format from file extension.
+fn deserialize_policy(content: &str, path: &Path) -> anyhow::Result<PolicyDocument> {
+    let ext = path
+        .extension()
+        .and_then(|e| e.to_str())
+        .unwrap_or("")
+        .to_ascii_lowercase();
+
+    match ext.as_str() {
+        "yaml" | "yml" => {
+            parse_policy_yaml(content).map_err(|e| anyhow::anyhow!("invalid YAML policy at {}: {e}", path.display()))
+        }
+        _ => parse_policy_json(content).map_err(|e| anyhow::anyhow!("invalid JSON policy at {}: {e}", path.display())),
+    }
+}
+
+/// Find the policy file in the default location.
+///
+/// Searches for `package-broker-policy.{json,yaml,yml}` in priority order.
+pub fn find_default_policy() -> anyhow::Result<PathBuf> {
+    let dir = default_policy_dir();
+
+    for ext in POLICY_EXTENSIONS {
+        let path = dir.join(format!("{POLICY_FILE_BASE}.{ext}"));
+        if path.exists() {
+            return Ok(path);
+        }
+    }
+
+    anyhow::bail!(
+        "policy file not found in {}; create package-broker-policy.{{json,yaml,yml}} to enable the broker",
+        dir.display()
+    )
+}
diff --git a/devolutions-agent/src/broker/policy_watcher.rs b/devolutions-agent/src/broker/policy_watcher.rs
new file mode 100644
index 000000000..b8be9ee81
--- /dev/null
+++ b/devolutions-agent/src/broker/policy_watcher.rs
@@ -0,0 +1,134 @@
+//! Policy file watcher with live reload.
+//!
+//! Watches the policy file for changes and reloads it when modified.
+//! If the file becomes unavailable or corrupted, the broker pauses
+//! (denies all requests) until a valid policy is available again.
+
+use std::path::{Path, PathBuf};
+use std::sync::Arc;
+use std::time::Duration;
+
+use notify::{RecommendedWatcher, RecursiveMode, Watcher};
+use now_policy::PolicyDocument;
+use tokio::sync::{Notify, watch};
+
+use crate::broker::policy_loader;
+
+/// State of the policy: either loaded and active, or unavailable.
+#[derive(Debug, Clone)]
+pub enum PolicyState {
+    /// A valid policy is loaded and active.
+    Active(Arc<PolicyDocument>),
+    /// The policy file is missing or corrupted; broker should deny all requests.
+    Unavailable { reason: String },
+}
+
+/// Watches a policy file (JSON or YAML) and sends updates via a channel.
+///
+/// On startup, attempts to load the policy. If it fails, starts in `Unavailable` state.
+/// When the file is modified, reloads it. If reload fails, transitions to `Unavailable`.
+/// When a valid file becomes available again, transitions back to `Active`.
+pub struct PolicyWatcher {
+    path: PathBuf,
+    state_tx: watch::Sender<PolicyState>,
+}
+
+impl PolicyWatcher {
+    /// Create a new watcher for the given policy file path.
+    ///
+    /// Returns the watcher and a receiver for policy state changes.
+    pub fn new(path: PathBuf) -> (Self, watch::Receiver<PolicyState>) {
+        let initial_state = match policy_loader::load_policy(&path) {
+            Ok(policy) => PolicyState::Active(Arc::new(policy)),
+            Err(e) => PolicyState::Unavailable { reason: e.to_string() },
+        };
+
+        let (state_tx, state_rx) = watch::channel(initial_state);
+
+        let watcher = Self { path, state_tx };
+
+        (watcher, state_rx)
+    }
+
+    /// Start watching the policy file for changes.
+    ///
+    /// This spawns a background task that watches the policy file's parent directory
+    /// and reloads the policy when the file is modified, created, or removed.
+    /// The task runs until the shutdown notify is triggered.
+    pub async fn watch(self, shutdown: Arc<Notify>) {
+        let path = self.path.clone();
+        let state_tx = self.state_tx;
+        let dir = path.parent().unwrap_or_else(|| Path::new(".")).to_owned();
+
+        let (fs_tx, mut fs_rx) = tokio::sync::mpsc::channel::<()>(16);
+        let (watcher_stop_tx, watcher_stop_rx) = std::sync::mpsc::channel::<()>();
+
+        // Set up file watcher in a blocking context.
+        let watch_path = dir.clone();
+        let _watcher_handle = tokio::task::spawn_blocking(move || {
+            let rt_tx = fs_tx;
+            let mut watcher: RecommendedWatcher =
+                match notify::recommended_watcher(move |res: notify::Result<notify::Event>| {
+                    if let Ok(event) = res {
+                        // Only react to modify/create/remove events.
+                        use notify::EventKind;
+                        match event.kind {
+                            EventKind::Modify(_) | EventKind::Create(_) | EventKind::Remove(_) => {
+                                let _ = rt_tx.blocking_send(());
+                            }
+                            _ => {}
+                        }
+                    }
+                }) {
+                    Ok(watcher) => watcher,
+                    Err(error) => {
+                        tracing::error!(%error, "Failed to create policy file watcher");
+                        return;
+                    }
+                };
+
+            if let Err(error) = watcher.watch(&watch_path, RecursiveMode::NonRecursive) {
+                tracing::error!(%error, path = %watch_path.display(), "Failed to watch policy directory");
+                return;
+            }
+
+            let _ = watcher_stop_rx.recv();
+        });
+
+        // Debounce interval to avoid rapid reloads.
+        let debounce = Duration::from_millis(500);
+
+        loop {
+            tokio::select! {
+                _ = shutdown.notified() => {
+                    tracing::info!("Policy watcher shutting down");
+                    let _ = watcher_stop_tx.send(());
+                    break;
+                }
+                Some(()) = fs_rx.recv() => {
+                    // Debounce: drain any additional events that arrived.
+                    tokio::time::sleep(debounce).await;
+                    while fs_rx.try_recv().is_ok() {}
+
+                    // Attempt reload.
+                    match policy_loader::load_policy(&path) {
+                        Ok(policy) => {
+                            tracing::info!(
+                                policy_id = %policy.metadata.id,
+                                revision = policy.metadata.revision,
+                                "Policy reloaded successfully"
+                            );
+                            let _ = state_tx.send(PolicyState::Active(Arc::new(policy)));
+                        }
+                        Err(e) => {
+                            tracing::warn!(error = %e, "Policy reload failed; broker paused");
+                            let _ = state_tx.send(PolicyState::Unavailable {
+                                reason: e.to_string(),
+                            });
+                        }
+                    }
+                }
+            }
+        }
+    }
+}
diff --git a/devolutions-agent/src/broker/scenario_tests.rs b/devolutions-agent/src/broker/scenario_tests.rs
new file mode 100644
index 000000000..e2ebab6a0
--- /dev/null
+++ b/devolutions-agent/src/broker/scenario_tests.rs
@@ -0,0 +1,131 @@
+//! High-level scenario tests using sample policies and requests.
+//!
+//! These tests keep broad end-to-end coverage for the broker policy concepts.
+//! Detailed rule matching and constraint behavior is covered by lower-level unit tests.
+
+#![allow(clippy::unwrap_used)]
+
+use std::path::{Path, PathBuf};
+
+use now_policy::PolicyDocument;
+use now_policy_api::PackageRequest;
+use serde::Deserialize;
+
+use super::evaluator;
+
+/// Local samples directory bundled inside the crate.
+fn samples_dir() -> PathBuf {
+    PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("src/broker/assets/samples")
+}
+
+// ─── Scenario file structures ────────────────────────────────────────────────
+
+#[derive(Deserialize)]
+#[serde(rename_all = "PascalCase")]
+struct ScenarioSet {
+    scenarios: Vec<Scenario>,
+}
+
+#[derive(Deserialize)]
+#[serde(rename_all = "PascalCase")]
+struct Scenario {
+    id: String,
+    policy: String,
+    request: String,
+    expected_decision: String,
+    expected_rule_id: String,
+}
+
+// ─── Helper functions ────────────────────────────────────────────────────────
+
+fn load_json_file(path: &Path) -> serde_json::Value {
+    let content = std::fs::read_to_string(path).unwrap_or_else(|e| panic!("failed to read {}: {e}", path.display()));
+    serde_json::from_str(&content).unwrap_or_else(|e| panic!("failed to parse {}: {e}", path.display()))
+}
+
+fn load_policy(path: &Path) -> PolicyDocument {
+    let content = std::fs::read_to_string(path).unwrap_or_else(|e| panic!("failed to read {}: {e}", path.display()));
+    let ext = path.extension().and_then(|e| e.to_str()).unwrap_or("");
+    match ext {
+        "yaml" | "yml" => serde_yaml::from_str(&content)
+            .unwrap_or_else(|e| panic!("failed to deserialize YAML policy {}: {e}", path.display())),
+        _ => serde_json::from_str(&content)
+            .unwrap_or_else(|e| panic!("failed to deserialize policy {}: {e}", path.display())),
+    }
+}
+
+fn load_request(path: &Path) -> PackageRequest {
+    let value = load_json_file(path);
+    serde_json::from_value(value).unwrap_or_else(|e| panic!("failed to deserialize request {}: {e}", path.display()))
+}
+
+// ─── Scenario-driven evaluation tests ────────────────────────────────────────
+
+fn run_scenarios(scenario_file: &str) {
+    let dir = samples_dir();
+    let scenarios_path = dir.join("scenarios").join(scenario_file);
+    let content = std::fs::read_to_string(&scenarios_path)
+        .unwrap_or_else(|e| panic!("failed to read {}: {e}", scenarios_path.display()));
+    let scenario_set: ScenarioSet =
+        serde_json::from_str(&content).unwrap_or_else(|e| panic!("failed to parse scenarios: {e}"));
+
+    let mut failures: Vec<String> = Vec::new();
+
+    for scenario in &scenario_set.scenarios {
+        // Load policy.
+        let policy_path = dir.join(&scenario.policy);
+        let policy = match std::panic::catch_unwind(|| load_policy(&policy_path)) {
+            Ok(p) => p,
+            Err(_) => {
+                failures.push(format!("{}: failed to load policy {}", scenario.id, scenario.policy));
+                continue;
+            }
+        };
+
+        // Load request.
+        let request_path = dir.join(&scenario.request);
+        let request = match std::panic::catch_unwind(|| load_request(&request_path)) {
+            Ok(r) => r,
+            Err(_) => {
+                failures.push(format!("{}: failed to load request {}", scenario.id, scenario.request));
+                continue;
+            }
+        };
+
+        // Evaluate.
+        let decision = evaluator::evaluate(&policy, &request);
+
+        let expected_decision = match scenario.expected_decision.as_str() {
+            "Allow" => now_policy::Decision::Allow,
+            "Deny" => now_policy::Decision::Deny,
+            other => {
+                failures.push(format!("{}: unknown expectedDecision '{other}'", scenario.id));
+                continue;
+            }
+        };
+
+        if decision.decision != expected_decision {
+            failures.push(format!(
+                "{}: expected decision '{}' but got '{}' (rule: {})",
+                scenario.id, scenario.expected_decision, decision.decision, decision.rule_id
+            ));
+            continue;
+        }
+
+        if decision.rule_id != scenario.expected_rule_id {
+            failures.push(format!(
+                "{}: expected rule_id '{}' but got '{}'",
+                scenario.id, scenario.expected_rule_id, decision.rule_id
+            ));
+        }
+    }
+
+    if !failures.is_empty() {
+        panic!("{} scenario(s) failed:\n  {}", failures.len(), failures.join("\n  "));
+    }
+}
+
+#[test]
+fn core_policy_scenarios() {
+    run_scenarios("baseline.scenarios.json");
+}
diff --git a/devolutions-agent/src/broker/server/connection.rs b/devolutions-agent/src/broker/server/connection.rs
new file mode 100644
index 000000000..d8056685a
--- /dev/null
+++ b/devolutions-agent/src/broker/server/connection.rs
@@ -0,0 +1,30 @@
+//! Router and connection serving helpers.
+
+use hyper_util::rt::{TokioExecutor, TokioIo};
+use tokio::io::{AsyncRead, AsyncWrite};
+
+/// Serve one HTTP connection (a named-pipe instance or a TCP stream) using the router.
+pub async fn serve_connection<S>(stream: S, router: axum::Router)
+where
+    S: AsyncRead + AsyncWrite + Unpin + Send + 'static,
+{
+    use tower_service::Service as _;
+
+    let socket = TokioIo::new(stream);
+
+    let mut make_service = router.into_make_service();
+    let tower_service = match make_service.call(()).await {
+        Ok(service) => service,
+        Err(infallible) => match infallible {},
+    };
+    let hyper_service = hyper_util::service::TowerToHyperService::new(tower_service);
+
+    if let Err(error) = hyper_util::server::conn::auto::Builder::new(TokioExecutor::new())
+        .http1()
+        .keep_alive(false)
+        .serve_connection_with_upgrades(socket, hyper_service)
+        .await
+    {
+        tracing::warn!(error = %error, "Connection error");
+    }
+}
diff --git a/devolutions-agent/src/broker/server/execution.rs b/devolutions-agent/src/broker/server/execution.rs
new file mode 100644
index 000000000..3c817c9dc
--- /dev/null
+++ b/devolutions-agent/src/broker/server/execution.rs
@@ -0,0 +1,60 @@
+//! Background execution task handling.
+
+use std::sync::Arc;
+
+use now_policy_api::ResourceId;
+
+use crate::broker::executor::{CommandExecutor, ExecutionContext};
+use crate::broker::operation_tracker::OperationTracker;
+
+pub(super) fn spawn_execution(
+    executor: Arc<dyn CommandExecutor>,
+    tracker: OperationTracker,
+    operation_id: ResourceId,
+    context: ExecutionContext,
+) {
+    let exe_name = context.command.first().cloned().unwrap_or_else(|| "process".to_owned());
+    let operation_id_string = operation_id.to_string();
+
+    tokio::spawn(async move {
+        let timeout = OperationTracker::operation_timeout();
+        match tokio::time::timeout(timeout, executor.execute(&context)).await {
+            Ok(Ok(output)) => {
+                let stdout = (!output.stdout.is_empty()).then_some(output.stdout);
+                let note = if output.exit_code == 0 {
+                    "process exited successfully".to_owned()
+                } else {
+                    #[allow(clippy::cast_sign_loss)]
+                    let unsigned = output.exit_code as u32;
+                    match crate::broker::executor::describe_exit_code(output.exit_code) {
+                        Some(description) => format!(
+                            "{exe_name} exited with code {} (0x{unsigned:08X}): {description}",
+                            output.exit_code
+                        ),
+                        None => format!("{exe_name} exited with code {} (0x{unsigned:08X})", output.exit_code),
+                    }
+                };
+                tracing::info!(
+                    operation_id = %operation_id_string,
+                    exit_code = output.exit_code,
+                    "Background execution completed"
+                );
+                tracker.mark_completed(&operation_id_string, output.exit_code, note, stdout);
+            }
+            Ok(Err(error)) => {
+                let note = format!("{error:#}");
+                tracing::error!(operation_id = %operation_id_string, %error, "Background execution failed");
+                tracker.mark_failed(&operation_id_string, note, None);
+            }
+            Err(_elapsed) => {
+                let note = format!("operation timed out after {} seconds", timeout.as_secs());
+                tracing::error!(
+                    operation_id = %operation_id_string,
+                    timeout_secs = timeout.as_secs(),
+                    "Background execution timed out"
+                );
+                tracker.mark_failed(&operation_id_string, note, None);
+            }
+        }
+    });
+}
diff --git a/devolutions-agent/src/broker/server/mod.rs b/devolutions-agent/src/broker/server/mod.rs
new file mode 100644
index 000000000..b60031410
--- /dev/null
+++ b/devolutions-agent/src/broker/server/mod.rs
@@ -0,0 +1,304 @@
+//! Runtime implementation of the shared NOW package broker server facade.
+
+use std::sync::{Arc, RwLock};
+
+use async_trait::async_trait;
+use base64::Engine as _;
+use chrono::{DateTime, Utc};
+use now_policy::PolicyDocument;
+use now_policy_api::{
+    Base64Utf8Data, CapabilitiesResponse, CapabilitiesResponseKind, Decision, DecisionInfo, ErrorCode, ErrorResponse,
+    EvaluationResponse, EvaluationResponseKind, ExecutionResponse, ExecutionResponseKind, HealthResponse,
+    HealthResponseKind, HealthStatus, OperationStatus, OperationSubmission, PackageRequest, StatusRequest,
+    StatusResponse, StatusResponseKind, Transport,
+};
+use now_policy_server_template::{MAX_REQUEST_BODY_BYTES, PackageBrokerServer, SharedPackageBrokerServer};
+
+use crate::broker::auth::PipeClient;
+use crate::broker::command_builder::build_command;
+use crate::broker::evaluator;
+use crate::broker::executor::{CommandExecutor, ExecutionContext};
+use crate::broker::operation_tracker::OperationTracker;
+
+mod connection;
+mod execution;
+mod responses;
+
+pub use connection::serve_connection;
+use responses::{
+    api_version, default_manager_capabilities, diagnostics, error_response, new_operation_id, parse_rule_id,
+    policy_info, policy_validity_failure, request_summary, server_context,
+};
+
+/// Shared server state.
+pub struct BrokerState {
+    /// Current policy. `None` means the broker is paused (policy file missing or corrupted).
+    pub policy: RwLock<Option<Arc<PolicyDocument>>>,
+    pub executor: Arc<dyn CommandExecutor>,
+    pub pipe_name: String,
+    pub tracker: OperationTracker,
+    pub skip_signature_validation: bool,
+}
+
+struct EvaluatedRequest {
+    policy: Arc<PolicyDocument>,
+    received_at: DateTime<Utc>,
+    completed_at: DateTime<Utc>,
+    decision: DecisionInfo,
+    would_execute: bool,
+    command: Vec<String>,
+}
+
+/// Build the axum router for a single authenticated pipe client.
+pub(crate) fn build_router_for_client(state: Arc<BrokerState>, client: PipeClient) -> axum::Router {
+    let server: SharedPackageBrokerServer = Arc::new(BrokerConnection { state, client });
+    axum::Router::from(now_policy_server_template::api_router_from_shared(server))
+}
+
+struct BrokerConnection {
+    state: Arc<BrokerState>,
+    client: PipeClient,
+}
+
+#[async_trait]
+impl PackageBrokerServer for BrokerConnection {
+    async fn health(&self) -> HealthResponse {
+        self.state.health().await
+    }
+
+    async fn capabilities(&self) -> CapabilitiesResponse {
+        self.state.capabilities().await
+    }
+
+    async fn evaluate(&self, request: PackageRequest) -> Result<EvaluationResponse, ErrorResponse> {
+        self.client
+            .validate_request(&request, self.state.skip_signature_validation)
+            .map_err(|error| {
+                tracing::warn!(error = format!("{error:#}"), "Rejected package broker evaluate request");
+                error_response(ErrorCode::Unauthorized, "pipe client authentication failed")
+            })?;
+
+        self.state.evaluate(request).await
+    }
+
+    async fn execute(&self, request: PackageRequest) -> Result<ExecutionResponse, ErrorResponse> {
+        self.client
+            .validate_request(&request, self.state.skip_signature_validation)
+            .map_err(|error| {
+                tracing::warn!(error = format!("{error:#}"), "Rejected package broker execute request");
+                error_response(ErrorCode::Unauthorized, "pipe client authentication failed")
+            })?;
+
+        self.state.execute(request).await
+    }
+
+    async fn status(&self, request: StatusRequest) -> Result<StatusResponse, ErrorResponse> {
+        self.state.status(request).await
+    }
+}
+
+#[async_trait]
+impl PackageBrokerServer for BrokerState {
+    async fn health(&self) -> HealthResponse {
+        let policy_guard = self.policy.read().expect("policy lock poisoned");
+        let (status, policy_id) = match policy_guard.as_ref() {
+            Some(policy) => (HealthStatus::Ready, policy.metadata.id.to_string()),
+            None => (HealthStatus::Paused, String::new()),
+        };
+
+        HealthResponse {
+            response_kind: HealthResponseKind,
+            response_version: api_version(),
+            server: server_context(),
+            status,
+            policy_id,
+        }
+    }
+
+    async fn capabilities(&self) -> CapabilitiesResponse {
+        CapabilitiesResponse {
+            response_kind: CapabilitiesResponseKind,
+            response_version: api_version(),
+            server: server_context(),
+            transports: vec![Transport::HttpNamedPipe],
+            managers: default_manager_capabilities(),
+            max_request_body_bytes: MAX_REQUEST_BODY_BYTES as u64,
+        }
+    }
+
+    async fn evaluate(&self, request: PackageRequest) -> Result<EvaluationResponse, ErrorResponse> {
+        let evaluated = self.evaluate_request(&request)?;
+
+        Ok(EvaluationResponse {
+            response_kind: EvaluationResponseKind,
+            response_version: api_version(),
+            server: server_context(),
+            request_id: request.request_id.clone(),
+            received_at: evaluated.received_at,
+            completed_at: evaluated.completed_at,
+            request: request_summary(&request),
+            decision: evaluated.decision,
+            would_execute: evaluated.would_execute,
+            policy: policy_info(&evaluated.policy),
+            diagnostics: diagnostics(&evaluated.command, request.include_command_preview)?,
+        })
+    }
+
+    async fn execute(&self, request: PackageRequest) -> Result<ExecutionResponse, ErrorResponse> {
+        let evaluated = self.evaluate_request(&request)?;
+        let operation = if evaluated.would_execute {
+            let generated_operation_id = new_operation_id()?;
+            let submitted_at = Utc::now();
+            let context = ExecutionContext {
+                kill_processes: request
+                    .options
+                    .kill_before_operation
+                    .iter()
+                    .map(|process| process.0.clone())
+                    .collect(),
+                pre_command: request.options.pre_operation_command.clone(),
+                command: evaluated.command.clone(),
+                post_command: request.options.post_operation_command.clone(),
+                effective_user: request.client.effective_user.clone(),
+                elevation: request.client.requested_elevation,
+                scope: request.options.scope,
+                capture_output: request.capture_output,
+            };
+
+            let (operation_id, is_new_operation) = self.tracker.register(&request.request_id, generated_operation_id);
+            if is_new_operation {
+                self.tracker.mark_running(&operation_id);
+                execution::spawn_execution(
+                    Arc::clone(&self.executor),
+                    self.tracker.clone(),
+                    operation_id.clone(),
+                    context,
+                );
+            }
+            let status = self
+                .tracker
+                .get(&operation_id)
+                .map_or(OperationStatus::Starting, |operation| operation.status);
+
+            Some(OperationSubmission {
+                operation_id,
+                status,
+                submitted_at,
+            })
+        } else {
+            None
+        };
+
+        Ok(ExecutionResponse {
+            response_kind: ExecutionResponseKind,
+            response_version: api_version(),
+            server: server_context(),
+            request_id: request.request_id.clone(),
+            received_at: evaluated.received_at,
+            completed_at: evaluated.completed_at,
+            request: request_summary(&request),
+            decision: evaluated.decision,
+            policy: policy_info(&evaluated.policy),
+            operation,
+            diagnostics: diagnostics(&evaluated.command, request.include_command_preview)?,
+        })
+    }
+
+    async fn status(&self, request: StatusRequest) -> Result<StatusResponse, ErrorResponse> {
+        let Some(operation) = self.tracker.get(&request.operation_id) else {
+            return Err(error_response(ErrorCode::NotFound, "operation not found"));
+        };
+
+        Ok(StatusResponse {
+            response_kind: StatusResponseKind,
+            response_version: api_version(),
+            server: server_context(),
+            operation_id: request.operation_id,
+            request_id: operation.request_id,
+            status: operation.status,
+            started_at: operation.started_at,
+            completed_at: operation.completed_at,
+            exit_code: operation.exit_code,
+            message: operation.note,
+            details: None,
+            stdout: operation
+                .stdout
+                .map(|stdout| Base64Utf8Data(base64::engine::general_purpose::STANDARD.encode(stdout))),
+        })
+    }
+}
+
+impl BrokerState {
+    fn evaluate_request(&self, request: &PackageRequest) -> Result<EvaluatedRequest, ErrorResponse> {
+        let received_at = Utc::now();
+        let policy = {
+            let guard = self.policy.read().expect("policy lock poisoned");
+            match guard.as_ref() {
+                Some(policy) => Arc::clone(policy),
+                None => {
+                    return Err(error_response(
+                        ErrorCode::BrokerPaused,
+                        "policy file is unavailable or corrupted",
+                    ));
+                }
+            }
+        };
+
+        if let Some(reason) = policy_validity_failure(&policy, received_at) {
+            tracing::warn!(%reason, "Rejecting request: policy outside validity window");
+            return Err(error_response(ErrorCode::Forbidden, reason));
+        }
+
+        tracing::trace!(
+            operation = %request.operation,
+            manager = %request.manager,
+            package_id = %request.package.id,
+            request_id = %request.request_id,
+            "Evaluating policy for request",
+        );
+
+        let decision = evaluator::evaluate(&policy, request);
+        let audit_mode = policy.enforcement.audit_mode == Some(true);
+        if audit_mode {
+            tracing::info!(
+                real_decision = %decision.decision,
+                rule_id = %decision.rule_id,
+                "Audit mode enabled; decision is not enforced",
+            );
+        }
+
+        let effective_decision = if audit_mode {
+            Decision::Allow
+        } else {
+            decision.decision.into()
+        };
+
+        let reason = if audit_mode && decision.decision != now_policy::Decision::Allow {
+            format!(
+                "[Audit mode] Not enforced. Policy decision was {} (rule '{}'): {}",
+                decision.decision, decision.rule_id, decision.reason
+            )
+        } else {
+            decision.reason
+        };
+
+        let command = if effective_decision == Decision::Allow {
+            build_command(request)
+        } else {
+            Vec::new()
+        };
+
+        Ok(EvaluatedRequest {
+            policy,
+            received_at,
+            completed_at: Utc::now(),
+            decision: DecisionInfo {
+                decision: effective_decision,
+                rule_id: parse_rule_id(&decision.rule_id)?,
+                reason,
+            },
+            would_execute: effective_decision == Decision::Allow,
+            command,
+        })
+    }
+}
diff --git a/devolutions-agent/src/broker/server/responses.rs b/devolutions-agent/src/broker/server/responses.rs
new file mode 100644
index 000000000..5d172a82c
--- /dev/null
+++ b/devolutions-agent/src/broker/server/responses.rs
@@ -0,0 +1,148 @@
+//! NOW API response mapping helpers.
+
+use chrono::{DateTime, Utc};
+use now_policy::PolicyDocument;
+use now_policy_api::{
+    API_VERSION_STR, ApiVersion, Architecture, ErrorCode, ErrorResponse, ErrorResponseKind, ManagerCapability,
+    ManagerName, Operation, OperationDiagnostics, PackageRequest, RequestSummary, ResourceId, ResponsePolicyInfo,
+    RuleId, Scope, ServerContext, Transport,
+};
+
+use crate::broker::operation_tracker::OperationTracker;
+
+pub(super) fn api_version() -> ApiVersion {
+    API_VERSION_STR.into()
+}
+
+pub(super) fn server_context() -> ServerContext {
+    ServerContext {
+        server_version: env!("CARGO_PKG_VERSION").to_owned(),
+        transport: Transport::HttpNamedPipe,
+    }
+}
+
+pub(super) fn default_manager_capabilities() -> Vec<ManagerCapability> {
+    vec![
+        ManagerCapability {
+            manager: ManagerName::Winget,
+            operations: vec![Operation::Install, Operation::Update, Operation::Uninstall],
+            scopes: vec![Scope::User, Scope::Machine],
+            architectures: vec![
+                Architecture::X86,
+                Architecture::X64,
+                Architecture::Arm64,
+                Architecture::Neutral,
+            ],
+            supports_custom_parameters: true,
+            supports_custom_install_location: true,
+            supports_capture_output: true,
+            supports_details: true,
+            max_operation_timeout_seconds: Some(OperationTracker::operation_timeout().as_secs()),
+        },
+        ManagerCapability {
+            manager: ManagerName::PowerShell,
+            operations: vec![Operation::Install, Operation::Update, Operation::Uninstall],
+            scopes: vec![Scope::User, Scope::Machine],
+            architectures: vec![Architecture::Neutral],
+            supports_custom_parameters: true,
+            supports_custom_install_location: false,
+            supports_capture_output: true,
+            supports_details: false,
+            max_operation_timeout_seconds: Some(OperationTracker::operation_timeout().as_secs()),
+        },
+        ManagerCapability {
+            manager: ManagerName::PowerShell7,
+            operations: vec![Operation::Install, Operation::Update, Operation::Uninstall],
+            scopes: vec![Scope::User, Scope::Machine],
+            architectures: vec![Architecture::Neutral],
+            supports_custom_parameters: true,
+            supports_custom_install_location: false,
+            supports_capture_output: true,
+            supports_details: false,
+            max_operation_timeout_seconds: Some(OperationTracker::operation_timeout().as_secs()),
+        },
+    ]
+}
+
+pub(super) fn request_summary(request: &PackageRequest) -> RequestSummary {
+    RequestSummary {
+        manager: Some(request.manager),
+        source: Some(request.source.name.clone()),
+        package_id: Some(request.package.id.clone()),
+        operation: Some(request.operation),
+    }
+}
+
+pub(super) fn policy_info(policy: &PolicyDocument) -> ResponsePolicyInfo {
+    ResponsePolicyInfo {
+        id: policy.metadata.id.clone().into(),
+        revision: policy.metadata.revision,
+        policy_version: policy.policy_version.clone().into(),
+    }
+}
+
+pub(super) fn diagnostics(
+    command: &[String],
+    include_command_preview: bool,
+) -> Result<Option<OperationDiagnostics>, ErrorResponse> {
+    if !include_command_preview {
+        return Ok(None);
+    }
+
+    let mut command_preview = Vec::with_capacity(command.len());
+    for arg in command {
+        let parsed = now_policy_api::CommandString::parse(arg).map_err(|error| {
+            error_response(
+                ErrorCode::InternalError,
+                format!("failed to build command preview: {error}"),
+            )
+        })?;
+        command_preview.push(parsed);
+    }
+
+    Ok(Some(OperationDiagnostics { command_preview }))
+}
+
+pub(super) fn parse_rule_id(rule_id: &str) -> Result<RuleId, ErrorResponse> {
+    RuleId::parse(rule_id).map_err(|error| {
+        error_response(
+            ErrorCode::InternalError,
+            format!("invalid policy rule id in evaluation result: {error}"),
+        )
+    })
+}
+
+pub(super) fn new_operation_id() -> Result<ResourceId, ErrorResponse> {
+    let raw = format!("op-{}", uuid::Uuid::new_v4());
+    ResourceId::parse(&raw).map_err(|error| {
+        error_response(
+            ErrorCode::InternalError,
+            format!("failed to generate operation id: {error}"),
+        )
+    })
+}
+
+pub(super) fn policy_validity_failure(policy: &PolicyDocument, now: DateTime<Utc>) -> Option<String> {
+    if let Some(valid_from) = policy.metadata.valid_from
+        && now < valid_from
+    {
+        return Some(format!("policy is not active until {valid_from} (current time {now})"));
+    }
+    if let Some(valid_until) = policy.metadata.valid_until
+        && now > valid_until
+    {
+        return Some(format!("policy expired at {valid_until} (current time {now})"));
+    }
+    None
+}
+
+pub(super) fn error_response(code: ErrorCode, message: impl Into<String>) -> ErrorResponse {
+    ErrorResponse {
+        response_kind: ErrorResponseKind,
+        response_version: api_version(),
+        server: server_context(),
+        code,
+        message: message.into(),
+        details: Vec::new(),
+    }
+}
diff --git a/devolutions-agent/src/broker/task.rs b/devolutions-agent/src/broker/task.rs
new file mode 100644
index 000000000..cda9949c5
--- /dev/null
+++ b/devolutions-agent/src/broker/task.rs
@@ -0,0 +1,161 @@
+//! Package broker entry point
+
+use std::sync::{Arc, RwLock};
+
+use anyhow::Context as _;
+use async_trait::async_trait;
+use devolutions_gateway_task::{ShutdownSignal, Task};
+use tokio::sync::Notify;
+use tracing::info;
+
+use crate::broker::executor::{self, CommandExecutor};
+use crate::broker::pipe::DEFAULT_PIPE_NAME;
+use crate::broker::policy_loader;
+use crate::broker::policy_watcher::{PolicyState, PolicyWatcher};
+use crate::broker::server::BrokerState;
+
+/// Configuration for the broker task.
+#[derive(Debug, Clone)]
+pub struct BrokerTaskConfig {
+    /// Named pipe name to listen on.
+    pub pipe_name: String,
+    /// Path to the policy file. If `None`, uses the default location.
+    /// Supports `.json`, `.yaml`, and `.yml` extensions.
+    pub policy_path: Option<String>,
+    /// Skip Authenticode signature validation for the broker client executable.
+    pub skip_signature_validation: bool,
+}
+
+impl Default for BrokerTaskConfig {
+    fn default() -> Self {
+        Self {
+            pipe_name: DEFAULT_PIPE_NAME.to_owned(),
+            policy_path: None,
+            skip_signature_validation: false,
+        }
+    }
+}
+
+pub struct BrokerTask {
+    config: BrokerTaskConfig,
+}
+
+impl BrokerTask {
+    pub fn new(config: BrokerTaskConfig) -> Self {
+        Self { config }
+    }
+}
+
+#[async_trait]
+impl Task for BrokerTask {
+    type Output = anyhow::Result<()>;
+
+    const NAME: &'static str = "package-broker";
+
+    async fn run(self, mut shutdown_signal: ShutdownSignal) -> Self::Output {
+        // Resolve policy file path.
+
+        let policy_path = match &self.config.policy_path {
+            Some(path) => std::path::PathBuf::from(path),
+            None => policy_loader::find_default_policy().context("failed to find default broker policy")?,
+        };
+
+        // Create policy watcher with initial load attempt.
+        let (watcher, mut state_rx) = PolicyWatcher::new(policy_path.clone());
+
+        // Log initial state.
+        match &*state_rx.borrow() {
+            PolicyState::Active(policy) => {
+                info!(
+                    policy_id = %policy.metadata.id,
+                    policy_revision = %policy.metadata.revision,
+                    path = %policy_path.display(),
+                    "Loaded package broker policy"
+                );
+            }
+            PolicyState::Unavailable { reason } => {
+                tracing::warn!(
+                    %reason,
+                    path = %policy_path.display(),
+                    "Policy unavailable at startup; broker will pause until a valid policy is provided"
+                );
+            }
+        }
+
+        let executor: Arc<dyn CommandExecutor> = executor::create_platform_executor().into();
+
+        // Initialize BrokerState with current policy (or None if unavailable).
+        let initial_policy = match &*state_rx.borrow() {
+            PolicyState::Active(policy) => Some(Arc::clone(policy)),
+            PolicyState::Unavailable { .. } => None,
+        };
+
+        let state = Arc::new(BrokerState {
+            policy: RwLock::new(initial_policy),
+            executor,
+            pipe_name: self.config.pipe_name.clone(),
+            tracker: crate::broker::operation_tracker::OperationTracker::new(),
+            skip_signature_validation: self.config.skip_signature_validation,
+        });
+
+        // Bridge the agent's ShutdownSignal to the Notify used by subsystems.
+        let shutdown_notify = Arc::new(Notify::new());
+
+        // Spawn policy watcher task.
+        let watcher_shutdown = Arc::clone(&shutdown_notify);
+        tokio::spawn(async move {
+            watcher.watch(watcher_shutdown).await;
+        });
+
+        // Spawn policy state relay: updates BrokerState when policy watcher reports changes.
+        let relay_state = Arc::clone(&state);
+        let relay_shutdown = Arc::clone(&shutdown_notify);
+        tokio::spawn(async move {
+            loop {
+                tokio::select! {
+                    _ = relay_shutdown.notified() => break,
+                    result = state_rx.changed() => {
+                        if result.is_err() {
+                            // Sender dropped (watcher exited).
+                            break;
+                        }
+                        let new_policy = match &*state_rx.borrow_and_update() {
+                            PolicyState::Active(policy) => {
+                                info!(
+                                    policy_id = %policy.metadata.id,
+                                    revision = policy.metadata.revision,
+                                    "Policy hot-reloaded; broker resumed"
+                                );
+                                Some(Arc::clone(policy))
+                            }
+                            PolicyState::Unavailable { reason } => {
+                                tracing::warn!(%reason, "Policy became unavailable; broker paused");
+                                None
+                            }
+                        };
+                        *relay_state.policy.write().expect("policy lock poisoned") = new_policy;
+                    }
+                }
+            }
+        });
+
+        // Spawn pipe server.
+        let server_shutdown = Arc::clone(&shutdown_notify);
+        let server_handle = tokio::spawn({
+            let state = Arc::clone(&state);
+            async move { crate::broker::pipe::run_pipe_server(state, server_shutdown).await }
+        });
+
+        // Wait for agent shutdown signal.
+        shutdown_signal.wait().await;
+        tracing::info!("package broker received shutdown signal");
+        shutdown_notify.notify_waiters();
+
+        // Wait for the server task to finish.
+        match server_handle.await {
+            Ok(Ok(())) => Ok(()),
+            Ok(Err(error)) => Err(error).context("broker pipe server error"),
+            Err(error) => Err(error).context("broker server task panicked"),
+        }
+    }
+}
diff --git a/devolutions-agent/src/code_signing.rs b/devolutions-agent/src/code_signing.rs
new file mode 100644
index 000000000..0edd2badb
--- /dev/null
+++ b/devolutions-agent/src/code_signing.rs
@@ -0,0 +1,103 @@
+//! Windows code-signing validation helpers.
+
+use std::path::Path;
+
+use anyhow::{Context as _, bail};
+use win_api_wrappers::security::crypt::{AuthenticodeSignatureStatus, authenticode_status};
+
+/// List of allowed thumbprints for Devolutions code signing certificates.
+pub(crate) const DEVOLUTIONS_CERT_THUMBPRINTS: &[&str] = &[
+    "3f5202a9432d54293bdfe6f7e46adb0a6f8b3ba6",
+    "8db5a43bb8afe4d2ffb92da9007d8997a4cc4e13",
+    "50f753333811ff11f1920274afde3ffd4468b210",
+];
+
+pub(crate) fn certificate_sha1_thumbprint(cert_der: &[u8]) -> anyhow::Result<[u8; 20]> {
+    use windows::Win32::Security::Cryptography::{CALG_SHA1, CryptHashCertificate};
+
+    let mut thumbprint = [0u8; 20];
+    let mut thumbprint_size = u32::try_from(thumbprint.len()).expect("SHA-1 length fits in u32");
+
+    // SAFETY: `cert_der` points to encoded certificate bytes for the duration of the call.
+    // `thumbprint` and `thumbprint_size` are valid writable output pointers.
+    unsafe {
+        CryptHashCertificate(
+            None,
+            CALG_SHA1,
+            0,
+            cert_der,
+            Some(thumbprint.as_mut_ptr()),
+            &mut thumbprint_size,
+        )
+    }
+    .context("failed to calculate certificate thumbprint")?;
+
+    if usize::try_from(thumbprint_size).expect("thumbprint size fits in usize") != thumbprint.len() {
+        bail!("certificate thumbprint has unexpected length");
+    }
+
+    Ok(thumbprint)
+}
+
+pub(crate) fn is_devolutions_certificate_thumbprint(calculated_thumbprint: &[u8; 20]) -> bool {
+    DEVOLUTIONS_CERT_THUMBPRINTS.iter().any(|thumbprint| {
+        let mut thumbprint_bytes = [0u8; 20];
+        hex::decode_to_slice(thumbprint, &mut thumbprint_bytes)
+            .expect("BUG: Invalid thumbprint in `DEVOLUTIONS_CERT_THUMBPRINTS`");
+
+        &thumbprint_bytes == calculated_thumbprint
+    })
+}
+
+pub(crate) fn validate_devolutions_authenticode_signature(path: &Path) -> anyhow::Result<String> {
+    let wintrust_result = authenticode_status(path).with_context(|| {
+        format!(
+            "failed to read authenticode signature for client executable '{}'",
+            path.display()
+        )
+    })?;
+
+    if !matches!(wintrust_result.status, AuthenticodeSignatureStatus::Valid) {
+        bail!("client executable signature is not valid: {:?}", wintrust_result.status);
+    }
+
+    let signer = wintrust_result
+        .provider
+        .as_ref()
+        .and_then(|provider| provider.signers.first())
+        .context("client executable signature has no signer")?;
+    let signing_cert = signer
+        .cert_chain
+        .first()
+        .context("client executable signature has no signing certificate")?;
+
+    let thumbprint = certificate_sha1_thumbprint(&signing_cert.cert.encoded)?;
+    if !is_devolutions_certificate_thumbprint(&thumbprint) {
+        bail!(
+            "client executable is signed with an unexpected certificate thumbprint: {}",
+            hex::encode(thumbprint)
+        );
+    }
+
+    Ok(hex::encode(thumbprint))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn recognizes_devolutions_certificate_thumbprints() {
+        for thumbprint in DEVOLUTIONS_CERT_THUMBPRINTS {
+            let mut thumbprint_bytes = [0u8; 20];
+            hex::decode_to_slice(thumbprint, &mut thumbprint_bytes)
+                .expect("test thumbprint should be valid hexadecimal");
+            assert!(is_devolutions_certificate_thumbprint(&thumbprint_bytes));
+        }
+    }
+
+    #[test]
+    fn rejects_unknown_certificate_thumbprint() {
+        assert!(!is_devolutions_certificate_thumbprint(&[0u8; 20]));
+    }
+}
diff --git a/devolutions-agent/src/config.rs b/devolutions-agent/src/config.rs
index 1dc90f73b..1aba596d1 100644
--- a/devolutions-agent/src/config.rs
+++ b/devolutions-agent/src/config.rs
@@ -20,6 +20,7 @@ pub struct Conf {
     pub remote_desktop: RemoteDesktopConf,
     pub pedm: dto::PedmConf,
     pub session: dto::SessionConf,
+    pub package_broker: dto::PackageBrokerConf,
     pub tunnel: TunnelConf,
     pub psu_event_hub: dto::PsuEventHubConf,
     pub psu_grpc_agent: dto::PsuGrpcAgentConf,
@@ -124,6 +125,7 @@ impl Conf {
             remote_desktop,
             pedm: conf_file.pedm.clone().unwrap_or_default(),
             session: conf_file.session.clone().unwrap_or_default(),
+            package_broker: conf_file.package_broker.clone().unwrap_or_default(),
             psu_event_hub: conf_file.psu_event_hub.clone().unwrap_or_default(),
             psu_grpc_agent: conf_file.psu_grpc_agent.clone().unwrap_or_default(),
             tunnel: conf_file
@@ -486,6 +488,30 @@ pub mod dto {
         }
     }
 
+    #[derive(PartialEq, Eq, Debug, Clone, Serialize, Deserialize)]
+    #[serde(rename_all = "PascalCase")]
+    pub struct PackageBrokerConf {
+        /// Enable package broker module (disabled by default)
+        pub enabled: bool,
+        /// Named pipe name to listen on (optional, uses default if omitted)
+        #[serde(skip_serializing_if = "Option::is_none")]
+        pub pipe_name: Option<String>,
+        /// Path to the policy JSON file (optional, uses default location if omitted)
+        #[serde(skip_serializing_if = "Option::is_none")]
+        pub policy_path: Option<String>,
+    }
+
+    #[allow(clippy::derivable_impls)]
+    impl Default for PackageBrokerConf {
+        fn default() -> Self {
+            Self {
+                enabled: false,
+                pipe_name: None,
+                policy_path: None,
+            }
+        }
+    }
+
     #[derive(PartialEq, Eq, Debug, Clone, Serialize, Deserialize)]
     #[serde(rename_all = "PascalCase")]
     pub struct TunnelConf {
@@ -733,6 +759,10 @@ pub mod dto {
         #[serde(default, skip_serializing_if = "Option::is_none")]
         pub session: Option<SessionConf>,
 
+        /// Package broker configuration
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        pub package_broker: Option<PackageBrokerConf>,
+
         /// Agent Tunnel configuration
         #[serde(skip_serializing_if = "Option::is_none")]
         pub tunnel: Option<TunnelConf>,
@@ -774,6 +804,7 @@ pub mod dto {
                 proxy: None,
                 debug: None,
                 session: Some(SessionConf { enabled: false }),
+                package_broker: None,
                 tunnel: None,
                 psu_event_hub: None,
                 psu_grpc_agent: None,
@@ -853,6 +884,12 @@ pub mod dto {
         /// Useful for testing with unsigned or test-signed packages.
         #[serde(default)]
         pub skip_msi_signature_validation: bool,
+
+        /// Skip package broker client executable signature validation
+        ///
+        /// Useful for testing with unsigned or test-signed broker clients.
+        #[serde(default)]
+        pub skip_broker_signature_validation: bool,
     }
 
     /// Manual Default trait implementation just to make sure default values are deliberates
@@ -867,6 +904,7 @@ pub mod dto {
                 allow_unsafe_updater_urls: false,
                 skip_updater_hash_validation: false,
                 skip_msi_signature_validation: false,
+                skip_broker_signature_validation: false,
             }
         }
     }
diff --git a/devolutions-agent/src/lib.rs b/devolutions-agent/src/lib.rs
index 5fb601919..932495e51 100644
--- a/devolutions-agent/src/lib.rs
+++ b/devolutions-agent/src/lib.rs
@@ -5,6 +5,10 @@ use ctrlc as _;
 #[macro_use]
 extern crate tracing;
 
+#[cfg(windows)]
+pub mod broker;
+#[cfg(windows)]
+pub(crate) mod code_signing;
 pub mod config;
 pub mod domain_detect;
 pub mod enrollment;
diff --git a/devolutions-agent/src/service.rs b/devolutions-agent/src/service.rs
index 9eeb178b8..dfe2e107d 100644
--- a/devolutions-agent/src/service.rs
+++ b/devolutions-agent/src/service.rs
@@ -2,6 +2,10 @@ use std::time::Duration;
 
 use anyhow::Context;
 use devolutions_agent::AgentServiceEvent;
+#[cfg(windows)]
+use devolutions_agent::broker::pipe::DEFAULT_PIPE_NAME;
+#[cfg(windows)]
+use devolutions_agent::broker::task::{BrokerTask, BrokerTaskConfig};
 use devolutions_agent::config::ConfHandle;
 use devolutions_agent::log::AgentLog;
 use devolutions_agent::psu_event_hub::PsuEventHubTask;
@@ -216,6 +220,19 @@ async fn spawn_tasks(conf_handle: ConfHandle) -> anyhow::Result<TasksCtx> {
             tasks.register(PedmTask::new())
         }
 
+        if conf.package_broker.enabled {
+            let broker_config = BrokerTaskConfig {
+                pipe_name: conf
+                    .package_broker
+                    .pipe_name
+                    .clone()
+                    .unwrap_or_else(|| DEFAULT_PIPE_NAME.to_owned()),
+                policy_path: conf.package_broker.policy_path.clone(),
+                skip_signature_validation: conf.debug.skip_broker_signature_validation,
+            };
+            tasks.register(BrokerTask::new(broker_config));
+        }
+
         if conf.session.enabled {
             let session_manager = SessionManager::default();
             let tx = session_manager.service_event_tx();
diff --git a/devolutions-agent/src/updater/mod.rs b/devolutions-agent/src/updater/mod.rs
index 9b1652b4d..812d1696f 100644
--- a/devolutions-agent/src/updater/mod.rs
+++ b/devolutions-agent/src/updater/mod.rs
@@ -57,7 +57,7 @@ const STATUS_REFRESH_INITIAL_DELAY: Duration = Duration::from_secs(30);
 
 /// Interval between subsequent unconditional `update_status.json` refreshes.
 ///
-/// This catches manual re-installations or any other external change that the
+/// This catches manual re-installations or any other external change tt phat the
 /// update-triggered refresh would miss.
 const STATUS_REFRESH_INTERVAL: Duration = Duration::from_secs(5 * 60);
 
diff --git a/devolutions-agent/src/updater/package.rs b/devolutions-agent/src/updater/package.rs
index 6484fc54c..3289c82d2 100644
--- a/devolutions-agent/src/updater/package.rs
+++ b/devolutions-agent/src/updater/package.rs
@@ -6,16 +6,10 @@ use camino::{Utf8Path, Utf8PathBuf};
 use uuid::Uuid;
 use win_api_wrappers::utils::WideString;
 
+use crate::code_signing::{certificate_sha1_thumbprint, is_devolutions_certificate_thumbprint};
 use crate::updater::io::remove_file_on_reboot;
 use crate::updater::{AGENT_UPDATE_IN_PROGRESS, Product, UpdaterCtx, UpdaterError};
 
-/// List of allowed thumbprints for Devolutions code signing certificates
-const DEVOLUTIONS_CERT_THUMBPRINTS: &[&str] = &[
-    "3f5202a9432d54293bdfe6f7e46adb0a6f8b3ba6",
-    "8db5a43bb8afe4d2ffb92da9007d8997a4cc4e13",
-    "50f753333811ff11f1920274afde3ffd4468b210",
-];
-
 /// Filename of the updater shim executable installed alongside the agent.
 const AGENT_UPDATER_SHIM_NAME: &str = "DevolutionsAgentUpdater.exe";
 
@@ -403,9 +397,7 @@ pub(crate) fn validate_package(ctx: &UpdaterCtx, path: &Utf8Path) -> Result<(),
 }
 
 fn validate_msi(ctx: &UpdaterCtx, path: &Utf8Path) -> Result<(), UpdaterError> {
-    use windows::Win32::Security::Cryptography::{
-        CALG_SHA1, CERT_CONTEXT, CertFreeCertificateContext, CryptHashCertificate,
-    };
+    use windows::Win32::Security::Cryptography::{CERT_CONTEXT, CertFreeCertificateContext};
     use windows::Win32::System::ApplicationInstallationAndServicing::{
         MSI_INVALID_HASH_IS_FATAL, MsiGetFileSignatureInformationW,
     };
@@ -458,10 +450,6 @@ fn validate_msi(ctx: &UpdaterCtx, path: &Utf8Path) -> Result<(), UpdaterError> {
         });
     }
 
-    const SHA1_HASH_SIZE: u8 = 20;
-    let mut calculated_cert_sha1 = [0u8; SHA1_HASH_SIZE as usize];
-    let mut calculated_cert_sha1_size = u32::from(SHA1_HASH_SIZE);
-
     // SAFETY: `cert_context.0` validity is checked above.
     let cert_data = unsafe { (*cert_context.0).pbCertEncoded };
     // SAFETY: `cert_context.0` validity is checked above.
@@ -475,32 +463,12 @@ fn validate_msi(ctx: &UpdaterCtx, path: &Utf8Path) -> Result<(), UpdaterError> {
         )
     };
 
-    // SAFETY: `encoded_slice` validity is ensured by `OwnedCertContext`, and `calculated_cert_sha1`
-    // and `calculated_cert_sha1_size` are valid pointers, therefore the function is safe to call.
-    unsafe {
-        CryptHashCertificate(
-            None,
-            CALG_SHA1,
-            0,
-            encoded_slice,
-            Some(&mut calculated_cert_sha1 as *mut u8),
-            &mut calculated_cert_sha1_size as *mut u32,
-        )
-    }
-    .map_err(|_| UpdaterError::MsiCertHash {
+    let calculated_cert_sha1 = certificate_sha1_thumbprint(encoded_slice).map_err(|_| UpdaterError::MsiCertHash {
         product: ctx.product,
         msi_path: path.to_owned(),
     })?;
 
-    let is_thumbprint_valid = DEVOLUTIONS_CERT_THUMBPRINTS.iter().any(|thumbprint| {
-        let mut thumbprint_bytes = [0u8; 20];
-        hex::decode_to_slice(thumbprint, &mut thumbprint_bytes)
-            .expect("BUG: Invalid thumbprint in `DEVOLUTIONS_CERT_THUMBPRINTS`");
-
-        thumbprint_bytes == calculated_cert_sha1
-    });
-
-    if !is_thumbprint_valid {
+    if !is_devolutions_certificate_thumbprint(&calculated_cert_sha1) {
         return Err(UpdaterError::MsiCertificateThumbprint {
             product: ctx.product,
             thumbprint: hex::encode(calculated_cert_sha1),