What is Tessera?

Tessera sits between your people and your infrastructure. Engineers connect with ssh, kubectl, a database client, or an RDP window; Tessera authorizes the request, injects the real credential on the wire, and records the session. Users never see a password, private key, or kubeconfig — credentials stay on the controller, access is granted rather than distributed, and every action is audited.

What you can broker

Target kind	Users connect with	Tessera injects
SSH	ssh, scp/sftp, the built-in terminal	username + password or private key
Kubernetes	kubectl and any kubeconfig-based tool	cluster bearer token or client certificate
Database	psql / mysql and GUI clients (PostgreSQL, MySQL)	database username + password
RDP	a native remote-desktop window	Windows username + password (delivered to the app, injected into the bundled RDP client in memory)

Capabilities

Capability	Summary
Credential injection	For SSH, Kubernetes and databases the secret never leaves the controller. RDP is the exception: the protocol needs the credential before the session exists, so it is delivered to your local client, never shown in the UI, and each issuance is audited
Just-in-time access	Request scoped, time-boxed access with approval and auto-revocation
RBAC	Grants of view / read-only / read-write, enforced live
Read-only sessions	Mutating commands and queries filtered, downgradable on the fly
Session recording	Full replay for terminals, per-command / per-request audit
SSO & provisioning	OIDC sign-in and SCIM user provisioning/deprovisioning
Audit & SIEM	Immutable log with JSON export to any collector
Clients	Desktop app (multi-account, built-in terminal, native RDP) and a CLI

Next

• Key concepts — the five ideas behind Tessera.
• Deploy the controller — get one running.