Book a demo Buy online
PlatformDelivery BoardAutomation & RunbooksOutcome ReceiptsJust-in-Time ElevationCredential VaultGoverned SessionsDevices & DiscoveryPatch ManagementReporting & ExportsRoles & Multi-Tenancy
Verified AI OperationsThe Operation LoopCommanded AutonomyCompare the operating modelThe Verified Operation Spec
SolutionsFor MSPsFor Enterprise & Internal ITHealthcareLegalFinancial servicesMunicipal & Education
ProofOperation walkthroughSecurity & architectureVerified Operation SpecFive questions for your RMM's AIChangelog
CompanyAboutFounder's noteContact
PricingBuy 1–20 technician licenses onlinePlans — from $499 per monthCustom requirementsFoundation Circle
Log in
Book a demoBuy online

Home/Platform/Devices & Discovery

The estate

Know the environment. Choose where to act.

An agent on a machine is not a nice-to-have here — it is the thing that makes a tunnel, a created credential and a target-side confirmation possible at all. Machines without one can still be found, still be worked on, and still be reported. They just cannot do those three things, and we would rather draw you that boundary than sell around it.

Check an agent boundarySee the operation loop
What enrollment establishes
identityA key pair generated on the machine. The private half never leaves it.
tenantThe workspace it belongs to. One at a time, never two.
transportAn outbound tunnel the machine dials. Never a port you open.
capabilityWhat this agent can be asked to do, declared rather than assumed.
removalUnenroll and the tunnel stops. Records already written stay where they are.

The boundary

No agent means no tunnel and no credential creation.

This is the part most platforms blur. An unmanaged machine is not a managed machine with fewer features switched on — there is nothing on it to dial out, and nothing on it to create an account with. Everything else follows from those two facts.

Managed against unmanagedwhere the line actually is
MANAGED — AGENT ENROLLED UNMANAGED — DISCOVERED ONLY Transport an outbound tunnel to the gateway dialled from the machine, always out none there is nothing on it to dial out Credentials created and rotated on the machine local and directory accounts we own cannot be created must already be vaulted, or held by the client How work arrives the job runs on the machine signed, under a leased identity brokered from a neighbour a nearby machine that does have an agent What we know hardware, OS, software, health the machine's own signed report what a scan could see a name, a port, a guess at the OS What proof is worth the target answers a fresh check and that answer is what the record carries only what the connection can ask weaker, and the record says so NO AGENT MEANS NO TUNNEL AND NO CREDENTIAL CREATION — A BOUNDARY, NOT A SMALLER PLAN
On an unmanaged target the identity has to come from somewhere else: a credential already in your vault, or one the client holds and types themselves at the moment of use. We will not invent an account on a machine we cannot reach.
Say this to your client Installing the agent is not us landing more software on their estate for its own sake. It is the difference between "the tool reports the service restarted" and "the server answered a fresh check and said it is running". That sentence is the entire product, and it needs something on the machine to be true.

How a machine gets here

Found, then enrolled, then targetable.

Discovery tells you what exists. Enrollment turns one of those things into a machine you can prove work on. They are two steps, and a good onboarding walks the gap between them deliberately.

  1. Discovery finds what is out there

    A scan run from a machine that already has an agent, plus reads of the directory you already run, build a picture of the estate: hosts, operating systems, who is privileged, what looks unmanaged. It is the first honest inventory most clients have had in years.

    Sources: a broker-driven network scan · your directory · what enrolled machines can see around them

  2. Enrollment makes a machine answerable

    The agent generates its own key pair, the private half never leaves the machine, and the device is bound to exactly one tenant. From that moment it can dial the tunnel, run a signed job, and answer an independent check about its own state.

    This is the moment a machine crosses from unmanaged to managed — and it is the onboarding conversation, not a technicality.

  3. Targeting picks it for an operation

    An operation names a target and the platform resolves what that means: is there an agent, is there a tunnel, which credential reference applies, what privilege has to be leased. The model names the operation; the code derives the least privilege that operation needs.

    Read the loop end to end on How it works.

  • We do not manage network appliances — firewalls, switches, security boxes. Reaching those through a local gateway object is something we intend to build, not something you can buy today.
  • We do not claim macOS or Linux agents. Windows is what ships.

What a row actually carries

Every field on a device row can name its source.

An inventory that cannot tell you where a value came from is a list of assertions. Colour-code the same row by provenance and it becomes something you can reason about — especially the fields that come from a scan rather than from the machine.

One device row, by provenanceSRV-ACCT-02
DEVICE RECORD SRV-ACCT-02 NAME AND ROLE SRV-ACCT-02 · file and print FIRST SEEN found by a network scan AGENT AND KEYS enrolled · key held on the device OPERATING SYSTEM Windows Server · build reported INSTALLED SOFTWARE collected on a schedule PATCH POSTURE measured against your baseline OPERATIONS OP-000217 and four others WHERE EACH FIELD COMES FROM The machine's own report Signed by the key that machine holds. This is the server answering, not a console guessing on its behalf. Enrollment Set once, when the machine joined: identity, keys, and the one tenant it belongs to. Discovery What a scan could see from the network. For a machine with no agent, this is the only source there is. The operation ledger Every operation that has touched it, by reference. The record belongs to the operation, not to the machine. A RECEIPT NAMES A DEVICE AT A MOMENT — IT DOES NOT BELONG TO THE DEVICE
Move SRV-ACCT-02 to a different client tomorrow and none of its history travels with it. The old tenant keeps every record it earned and the new one starts clean. Evidence is point-in-time by design — a device that carried its own audit trail between owners would be a leak, not a feature.

Installed software is collected from every enrolled machine and kept. What is still being built is the surface on top of it — a searchable software view, and a planner that reasons over what is installed before it proposes a fix. Today it is a collected, retained inventory, and we would rather say that than call it software asset management.

Targeting

An operation names a machine. The platform works out what that costs.

You do not hand a script a hostname here. The target is resolved into a set of facts, and those facts decide what privilege gets leased and whether the work can be proven at all.

What resolving a target settles
reachabilityIs there an agent and a live tunnel, or does this have to be brokered?
identityWhich vault reference applies, and whether one has to be created.
privilegeThe narrowest lease this specific operation needs on this specific machine.
verificationWhat independent check will be run afterwards, and by whom.
concurrencyWhether something else already holds this machine.
  • The model names the operation. Code derives the least privilege it needs — the model never gets to ask for more.
  • A target with no agent is not silently downgraded. The plan says it is brokered, and the record says the same.
  • One machine, one remote session. If someone already holds it, you find out before you connect.
  • Bulk work fans out per target. Each machine gets its own isolated record, so one failure in fifty does not smear across the batch.
Enrolled agents Directory reads Broker-driven scans Per-target records

What people ask before rolling an agent out.

Can you work on a machine with no agent at all?

Yes, within a real limit. The work is brokered from a managed machine nearby and the identity has to come from your vault or from the client at the moment of use. What you cannot get is a created credential, a direct tunnel, or a confirmation from the target's own agent — because there is no agent on it to give you one. The record reflects that, rather than dressing it up as the same thing.

What does the agent actually do when it is idle?

It holds an outbound connection, reports its own state, and waits. It does not accept inbound connections and there is no port to open for it. Work only reaches it as a signed job that arrived down a tunnel the machine itself dialled. See the trust center.

What happens if a machine moves to another client?

It enrolls into the new tenant and nothing comes with it. Records stay with the tenant that owned the work when it happened, because evidence is a point-in-time statement about a device, not a property the device carries. See Roles & Multi-Tenancy.

Do you replace our RMM?

Not as a blanket claim, and we will not make one. Name the specific capability and we will tell you straight whether it ships, whether it is narrower than you think, or whether it is not there. What we do claim is the operation loop: leased privilege, model-blind execution, a target-side confirmation and a record. How we compare →

How do you find machines nobody told you about?

A scan brokered from a machine that already has an agent, plus reads of the directory you already run. The gap between "in the directory" and "actually enrolled" is usually the most uncomfortable and most useful number in an onboarding.

Point at your hardest machine

Ask what we can and cannot prove on it.

Bring the server nobody wants to touch. We will tell you which half of this page applies to it before you spend a minute on a rollout.

Book a demoPatch & compliance
← PreviousRoles & Multi-TenancyDistinct customers, identities and roles Next →Patch & ComplianceGoverned waves, verified results