Revoking access should be one act, not a hopeful tour of six consoles.
When an account is compromised, the question is not whether you can disable it. It is whether you can be sure that everything which trusted it has stopped — and in most estates that answer is assembled by hand, product by product, while the incident is still running.
One act · authored example
Decided once. Enforced at every machine.
The policy is decided in one place; the agent on each machine applies it locally — and reports back, so silence is visible instead of assumed.
38report enforcing the current policy
4report an older one, and are being updated — each names the version it holds
2have reported nothing this week — unobserved, which is not the same as complying
One policy decision reaches forty-four machines: thirty-eight report enforcing it, four report an older version and are being updated, and two have reported nothing, which the page counts as unobserved rather than compliant.
The argument
Access is decided in one place and enforced at every machine. The decision and the enforcement are deliberately separate: a central policy says who may do what, and the agent on each machine applies it locally — so enforcement keeps working when the network does not, and revoking something is a single act rather than a hope that six products all honoured it.
The second idea here is that a live session is not a standing permission. Releasing a held containment action requires proving who you are again, at that moment — so a stolen session, however valid, still cannot approve anything that changes your world.
Ask the access record
authored example, not live data
Reports here answer questions in plain language, and every sentence they return carries the evidence behind it. Pick a question an auditor actually asks.
The answer
Nine identities could reach billing-db in August. Two of them belong to people who left the company during the month — one lost access the same day, and one kept it for eleven days after their last working day.No. This organisation requires a second person, and with that rule on, the gate refuses a requester who tries to release their own held action — so this answer is a property of the configuration rather than a search result.Thirty-eight of forty-four machines report enforcing the current policy. Four report an older one and are being updated. Two have reported nothing at all this week — and that is not the same as complying.
The four drifted machines name which policy version they hold.
policy.silent · db-02, kiosk-11 · no attestation since 08-19
Unobserved rather than deviating. Nothing here infers compliance from silence.
Two machines are unmeasured, so this answer covers 42 of 44. A report that said "96% compliant" would be hiding exactly the two rows worth reading.
Scope & Honest LimitsThe honest limitsExpand · Full ledger →
We can only revoke what we are the authority for
Where another identity provider issues the credential, we can tell you it exists and stop it reaching your machines — we cannot end its session inside a third party's product.
An unmapped machine cannot enforce a decision
Enforcement happens where the agent runs. Somewhere with no agent is not covered by it, and coverage is reported as a count of machines rather than a percentage that flatters us.
A permission we never read is not enforced
If a policy declares something nothing consumes, the platform says so rather than accepting it quietly. Desired state you believe is in force but isn't is worse than a gap you know about.
Some questions have no answer, and get none
Where a field was never recorded, a report says it was never measured rather than returning a zero. A confident number is worth less than a stated gap.
What this layer deliberately does not do
It does not become your identity provider. If you already have one, this layer reads from it rather than asking you to migrate — replacing a working directory is a two-year project nobody asked for in the middle of a security purchase.
It also does not let a permission be granted permanently and quietly. Access to the most sensitive material is requested, approved by a second person, and used — with all three recorded — rather than sitting on an account indefinitely because someone needed it once.