The IT hub for your organisation
Who can reach production right now, and how would you prove it?
If answering takes three systems, a spreadsheet and somebody's memory, the answer is a guess. Statim is the authoritative record of who exists, what hardware exists and who can reach what, and it is where you change the answer. No Active Directory required.
Who can reach prod-bastion?
Access arrives directly or through a group, and the second path is the one that surprises people during a review. Every path is named, and any of them can be withdrawn from here.
Where is MBP-4412, and does it still hold company data?
A machine that stopped checking in is not a machine that is fine. The record knows when it was last seen, who held it, and whether its recovery key was ever escrowed.
- Platform
- macOS 15.1
- Serial
- cq78833955
- Last check-in
- 9 days ago
- Previously assigned
- Mallie O'Keefe
- Recovery key
- Escrowed 14 Mar
- Desired state
- version 41, applied 38
The assigned person is leaving and this device has not been collected. It still holds company data and remains enrolled until it is returned or wiped.
Raised by offboarding · 9 days open
The leaver went on Friday. Did they actually lose access?
A checklist that reminds somebody to revoke access is how access gets left behind. Running a step here deprovisions the account, expires the grants and detaches every group.
Account deprovisioned. Sign-in is refused from now on.
Revoked 2 direct grants.
Removed from Production on-call, Engineering.
Unassigned 1 device and raised an alert until it is returned.
Why is this machine different from the others?
Intent and observation are separate records that never merge, so drift is something you can see rather than something you find out.
The contract
Desired state, never commands
The control plane publishes a document describing what a machine should look like. The agent observes, diffs, applies one action, reports, and looks again. There is no "run this script" message anywhere in the contract, because there is nowhere to put one.
The agent calls out and asks for the current document.
It reads the machine as it is, not as it was left.
Two typed records compared. Nothing is merged.
A single action, chosen from the difference.
What happened, including when it did not work.
Loss of connectivity is not an error. The machine keeps enforcing the last document it was given.
What the control plane publishes
{
"device_id": "0192f0c3-1b2c-7d3e-9f40-516273849a5b",
"version": 41,
"resources": [
{
"type": "sshd_config",
"name": "baseline",
"spec": {
"directives": {
"PasswordAuthentication": "no",
"PermitRootLogin": "no"
},
"validate_before_reload": true
}
},
{
"type": "local_account",
"name": "former-contractor",
"spec": { "state": "absent" }
}
],
"constraints": {
"maintenance_window": "02:00-05:00",
"reboot": "not_granted"
}
}Typed resources, a version that only moves forward, and constraints evaluated in the machine's own time zone. Rebooting is a grant the control plane gives, never a decision the agent makes.
What the contract guarantees
- Outbound only
- The agent opens every connection. Nothing on your network is reachable from ours, and a machine that loses connectivity keeps enforcing what it last knew.
- mTLS, and no shared secrets
- Device identity is a short-lived client certificate signed by a certificate authority belonging to your tenant alone. The only token in the system is a single-use enrollment token, burned when it is exchanged for one.
- Replay is refused, not tolerated
- Each document carries a version that only moves forward. The agent persists what it last applied and refuses anything that is not newer, or that names a different device than its certificate.
- Dangerous operations are signed separately
- Wipe, shell and certificate revocation carry a signature over canonical JSON from a key the web tier does not hold. The agent verifies it itself, independent of the transport.
The whole contract is written down as JSON Schema, with worked examples and a decision record for every choice, so your security team can review it before a single agent is installed.
The record
One place the answers live
An inventory tells you what is true. A hub also changes what is true, and writes down who changed it.
- Devices and servers
- Hardware, operating system, installed applications, and how far each machine has drifted from what it should be.
- People, groups and grants
- Every path from a person to a resource, and the ability to withdraw any of them from the same screen.
- Joiner, mover, leaver
- Processes that execute here rather than reminding somebody elsewhere, each step recording what it actually changed.
- Policies and desired state
- Declare what a group of machines should look like, and see what a change affects before you publish it.
- Alerts
- Derived from state rather than thresholds, each one carrying the evidence it was raised on.
- Audit and key escrow
- Append-only at the database level. Recovery keys sit under their own encryption, and reading one is itself an audited event that raises an alert.
Open your organisation's console
Each organisation has its own address. Enter the name yours was issued.
Ask it the question you cannot answer today
Bring the one that takes an afternoon and three systems. We will run it against a fleet that looks like yours.