What we are building, and why
Architecture, measurements and the trade-offs behind them. Everything checkable here is also in the documentation and reproducible on your own hardware.
Agents or a proxy: the access-control decision you make before you compare any features
An access tool asks one question before any feature list: does something get installed on your targets, or does it all go through a box in the middle?
-
One Go binary between your engineers and production: how we broker SSH, kubectl, psql and RDP — and what it costs
An honest walk through a broker-model access architecture: what happens on the wire, the ~20% throughput cost measured, and where certificates are the better answer.
-
Sizing a session broker: the unit is concurrent sessions, and the bottleneck is not the CPU
Why the planning unit is concurrent sessions rather than headcount, what a session costs in memory, and why the network saturates long before the CPU.
-
Four security decisions that look like nothing and are not
The choices that never make a feature list: refusing a forwarded-for header, validating targets against SSRF, pinning host keys, a console you cannot read back.
-
Standing access is the risk that never makes it onto the risk register
Every infrastructure post-mortem contains the same paragraph, and the access behind it was never sophisticated. Why permanent credentials stay invisible.
-
Auditors do not want your policy. They want an artefact.
An auditor cannot test a policy document. What they can test is an artefact with a timestamp on it — and the difference decides how an access review goes.
-
What running your own SSH certificate authority actually costs
An honest costing of the build side: the CA is a weekend, then come key rotation, host enrolment, revocation, break-glass and whoever carries it at 3am.
-
Your access tool is a vendor with a copy of your infrastructure map
A broker holds a list of every host, cluster and database you own, and who reaches them. Where that list lives is a residency question, and buyers ask it.
-
Privileged access management skipped everyone between 50 and 500 engineers
Privileged access management was built for enterprises with a compliance department, and below that size the tooling is a jump host and a spreadsheet.
Nothing matches that.