Security
Designed around trust, not convenience.
The security model is the architecture, not an add-on. Every layer is intentional and auditable.
Identity
Cryptographic server identity.
Authentication
Only authenticated clients can connect.
Authorization
Capability-based access control.
Encrypted Session
All management traffic is TLS-encrypted.
Audit
Administrative actions are recorded.
Encrypted Sessions
All management traffic — terminal input, file transfers, command output — is protected in transit with TLS. There is no plaintext channel between the client and the Agent.
Server Identity
Each Agent establishes a cryptographic identity on first provisioning. This identity is verified before any management session can be created, preventing impersonation.
Least Privilege
The Agent should not run every operation with maximum privileges. Operations are scoped, and the Agent limits itself to the capabilities granted by the current session.
Capability-Based Access
Operations are explicitly authorized. A session that can read logs cannot write files unless specifically granted that capability.
Credential Protection
The Agent never stores or transmits plaintext passwords. Authentication uses tokens and cryptographic proofs that are scoped and time-limited.
Auditability
Administrative operations can be logged for accountability. Every management action can be traced back to an authenticated session and user.
Agent Updates
Agent releases are verified before installation. Only signed updates are accepted, and the verification process is transparent to the administrator.