Every privileged session runs through a gateway that lives inside the customer network and only ever dials out. Here's the whole path — from install to a recorded, auto-expiring session.
Run a one-line installer inside each customer environment. It downloads a single prebuilt binary — no source, no inbound ports — dials out to the control plane, takes hold of credentials locally, and appears online. Run several per customer for high availability and automatic failover.
An operator asks for a role on an endpoint for a set window. A learned model scores the request: low-risk auto-approves; privileged roles queue for four-eyes sign-off and can require a fresh step-up MFA code — or be scheduled to open exactly when needed.
The gateway injects the credential and brokers the session in the browser — SSH, RDP, PostgreSQL, MySQL, Kubernetes. Every keystroke and command is captured onto a tamper-evident trail, and the grant is reaped the moment the window ends.
The gateway opens a persistent outbound tunnel to the control plane and to the session relay. When an operator connects, the browser reaches the relay over the same HTTPS origin as the console; the relay signals the gateway, which dials a session socket back and pipes the stream. There is never an inbound connection into the customer network — not for control, not for sessions.