Access Control & Identity
Fine-grained access control for every host and action. RBAC with custom roles and 600+ granular permissions, TOTP two-factor authentication, break-glass login and Active Directory domain join for your servers.
Authentication Methods
RBAC
Custom Roles
Create roles with a name, description and hand-picked permissions. 6 built-in roles: Root, Admin, Operator, Developer, Auditor, Viewer.
600+ Permissions
Fine-grained across 50+ categories, including settings, RBAC, compliance, alerts, backup, AI, dashboard and fleet.
Risk-Classified Permissions
Each permission is flagged by risk, and destructive actions ask for confirmation. Per-user permission grants on top of roles.
User Invitations
Expiring invite links with token acceptance, resend and revoke.
Permission Categories
- fs.read, fs.write, fs.delete — filesystem access
- exec.run — command execution
- service.start, service.stop, service.restart — service control
- packages.install — package management
- snapshot.create, snapshot.restore — snapshots
- fleet.*, compliance.*, alerts.* — feature-level
Session & Security Policies
- Session timeout configuration
- Active session listing and revocation
- Max login attempts with lockout
- Activity log of logins and user actions
- Configurable rate limits on login, token refresh and API calls
Integrations & Settings
TLS/HTTPS
Self-signed certificate generation or certificate upload (PEM).
Activity Log
Audit trail of logins and administrative actions, with online-user listing and admin password reset.
License Management
Key activation, plan and agent limits, expiration tracking with an offline grace period.