Access boundary
Route, scope, and shell
- Route preference
- —
- Allowed scope
- —
- Requested shell
- —
- Target state
- —
Host terminal session
Configure and supervise terminal access with route preferences, approvals, session state, and recent command history.
Checking connection
Governed remote access
Open a host shell only after the authority proves the boundary.
Preview resolves the exact device, route, scope, shell, approval policy, expiry, target-state version, and concurrency rows before anything is queued.
No session selected
Load an authority-issued session or define bounded access below.
Session state and lifecycle evidence remain empty until a UUID identifies a tenant-visible record.
Loading authority data
Resolving access scope, delivery state, and audit evidence…
Not found
This terminal session is not visible to the current tenant.
The identifier may be wrong, deleted, or outside this operator’s tenant boundary.
Permission required
Host terminal access is restricted.
Tunnel.HostTerminal.Start is required by the authority to preview, queue, and inspect these sessions.
Authority unavailable
Live host-terminal status is temporarily unavailable.
No cached session, fabricated transcript, or synthetic connection state is being substituted.
Invalid authority response
The host-terminal response could not be used.
Access details stay hidden until the service returns the complete governed contract.
Current host terminal request
— shell · —
Device —
——
Interactive transport not exposed
The authority queued an expiring command envelope; it does not return terminal bytes, credentials, or a connection endpoint.
This page can prove who requested which access boundary and whether the control plane accepted it. A device-agent transport contract must report connection readiness before Fleet can honestly render an interactive shell or copyable connection command.
Last checkpoint—
—
—
Governance
Purpose and approval
Operational reason
—
- Approval reference
- —
- Created
- —
Immutable request
Command-envelope evidence
- Envelope hash
- —
- Session ID
- —
- Concurrency rows
- —
CLI parity
Read authority status
Use your configured SaaS URL and a separately supplied Firebase token. Fleet never inserts or stores credential material in this page.
——Authority activity
Host-terminal lifecycle evidence
CoverageResolving
Final outcomeResolving
Use caseUC-031
Loading current lifecycle evidence…
No host-terminal events are available.
Current session state is available, but lifecycle evidence could not be loaded.
New host terminal request
Time-box the smallest useful access boundary.
Preview is read-only. Queueing requires the exact unchanged target, scope, route, shell, approval, expiry, and concurrency rows.
Authority preview
—
- Target
- —
- Route / scope
- —
- Shell
- —
- Expires
- —
- Approval
- —
- Target state
- —
- Envelope hash
- —
- Concurrency rows
- —