Skip to content

Practical examples

This section collects concrete scenarios that come up every week. Not a feature list — a list of actions with the shortest click paths, SQL queries or API calls that do the work.

RoleWhat you’ll find
SysadminTriaging fleet changes, kernel updates, alert noise, drift, on-call
AuditorPulling evidence, offline verification, control coverage, retention
DevOpsSLOs, deploy gates, supply-chain CVE auto-fix, LLM observability
MSPCross-tenant triage, white-label, pre-issued EATs, multi-party signing
  • Dashboard paths are written as /agents/<id> → Kernel tab
  • API calls are curl examples with Bearer $TOKEN; use your own token from /settings/api-tokens
  • SQL snippets are directly runnable in psql against the hub DB with set_config('app.current_tenant', '<uuid>', false) first — or replace current_setting(...) with your tenant_id
  • EAT flow always refers to Ed25519-signed Emergency Action Tokens. Nothing in these examples runs as root on a host without an EAT passing through TOTP + audit log + transparency log