From logged ticket to verified fix
This is the workflow CitadelGate is being built around. The ticket timeline, tenancy and ticket-bound PowerShell relay already run in the Gate portal. The agent and AI steps are in development.
The client logs a ticket
From the portal, by a technician on their behalf, or (planned) from an alert raised by the agent. Each ticket gets a stable number and is linked to the client and the affected device.
The agent supplies the evidence
The Windows agent reports approved device data such as services, disk, event log entries and print queue status. It never sends file contents.
AI explains and proposes
The AI summarises the evidence, says how confident it is, and proposes a fix with its target, effect, risk level and rollback.
Policy decides who presses go
If the fix is a low-risk library script and the client's policy allows it, it runs automatically. Otherwise the assigned technician reviews and approves it.
Run, verify, record
The signed script runs with a time limit, the result is checked, and the ticket gets the full record. If it didn't work, the ticket goes back to a person.
One console for every client you support
Real multi-tenancy
Provider, client, site, device group, device and user. Staff only reach a client through an explicit membership and role.
Tickets with context
Customer-visible messages and private technician notes on one timeline, linked to the device and any remote session.
Ticket-bound PowerShell
Terminal sessions are opened against a ticket number, so every command has a reason and a record.
MFA by default
Privileged actions need MFA. Client-scoped sessions are short-lived and rechecked on every request, and revoking access takes effect immediately.
Reports
Tenant-scoped CSV and JSON report files for supported report types, so you can show clients what was done.
Frame integration
CitadelFrame will send a limited security-status report into Gate: file hashes and scan metadata, never file contents.
What you can and can't do today
The Gate portal is live for provisioned accounts. There are no customer devices enrolled yet, and no customer workflow has been acceptance-tested. That is exactly what the early-access pilot is for.
Apply for the pilot| Capability | Status |
|---|---|
| Portal, sign-in, MFA, client switcher | Running |
| Numbered tickets and comments | Running |
| Ticket-bound PowerShell relay | Running |
| Outbound-only Windows agent | In testing |
| Signed agent installer | Planned |
| AI diagnosis and remediation | Planned |
| Staged script and software rollout | Planned |