SSH
A command on a host, with a card in front of it and the private key nowhere near the executor.
Nobody else in this category brokers SSH with a per-call approval and a sealed record of the session. An agent asks to run a command on a host; the whole command is on the card.
What the agent calls
web-01.exec { "cmd": "systemctl restart api" }Where the key is
The executor never receives a private key. It gets a handle that says "ssh signer", and asks the control plane to sign each authentication challenge over mutual TLS. A compromised executor replica holds nothing that opens a host tomorrow.
What the card shows
- The host, the user and the whole command, rendered from our canonical form rather than from the agent’s text.
- The agent, the person who delegated it, and the workspace.
- The class the command was given, and the rule that gave it.
Public hosts only in this version. A host inside a private network needs the connector, which is a later release. The egress guard refuses private addresses whether or not a binding names them.