Six layers between a click and a command
Tenant isolation
Provider, client, site, device group, device and user. Every query, ticket, command and session carries its client and is rechecked. Tests enforce isolation against a real PostgreSQL database.
Identity and MFA
MFA is required for every technician, administrator and owner. Client-scoped sessions last 15 minutes with no refresh token and are checked on every request. Revoking access blocks existing tokens immediately.
Separate permissions
Remote sessions, script runs, software deployment and role changes are separate permissions. Device credentials can't use human ticket, session or management endpoints.
Outbound-only agent
The Windows agent connects out to Gate over TLS. Enrolment is one-time and revocable, and agent updates are designed to be signed and verified before they install.
Ticket-bound actions
A PowerShell session or job is tied to a ticket number. No ticket, no command.
Complete audit trail
Each session or command records the actor, client, device, ticket, approval or consent state, script hash, timestamps, expiry, result and cancellation. Entries are hash-chained and append-only, so changes are detectable.
Rules for AI and automated fixes
AI remediation is built and in testing. These are the rules it follows.
- Automatic runs are limited to signed library scripts labelled low risk.
- Each client opts in, and can limit scripts or set maintenance windows.
- AI-written PowerShell always needs technician approval.
- Automatic fixes target only the device on the ticket.
- Jobs are immutable once approved, time-limited and cancellable.
- Bulk changes (planned) will start on a canary device and move in bounded waves.
- The AI receives metadata and telemetry, not file contents.
- Failed or ineffective fixes go to a person; there are no retry loops.
Consent comes first
Planned remote sessions come in two forms. Attended access asks the person at the computer to accept. Unattended access is only allowed for an enrolled client whose policy explicitly permits it, and is still logged against a ticket.
Where Gate runs
The Gate API, worker and PostgreSQL database run in containers on infrastructure operated by Kemptechnology (PTY) Ltd, behind TLS at gate.citadelframe.com. Database backups are taken and verified before each schema change.