Delegation boundary
Target, route, and expiry
- Fleet
- —
- Route preference
- —
- Allowed scope
- —
- Created
- —
Support Access Grant
Operate access, terminal, tunnel, and command workflows for support access grant.
Checking connection
Delegated device access
Grant support access only inside a boundary the authority can prove.
Preview resolves the device, route, coarse scope, approval, expiry, target state, and concurrency rows before a support session is queued.
No grant selected
Load an authority-issued grant or define a bounded support session below.
Effective state and lifecycle evidence remain empty until a UUID identifies a tenant-visible record.
Loading authority data
Resolving support scope, governance, and lifecycle evidence…
Not found
This support grant is not visible to the current tenant.
The identifier may be wrong, deleted, or outside this operator’s tenant boundary.
Permission required
Support delegation is restricted.
SupportAccess.Grant is required by the authority to preview, queue, and inspect these grants.
Authority unavailable
Live support-grant status is temporarily unavailable.
No cached grant or fabricated authorization is being substituted.
Invalid authority response
The support-access response could not be used.
Delegation details stay hidden until the service returns the complete governed contract.
Current support access grant
— access
Device —
——
Grantee, capabilities, and revocation not exposed
This authority queues device support access, but it does not identify a separate grantee or return effective capability policy.
The current contract exposes one coarse scope, route, approval reference, and expiry. It has no revoke endpoint or device-agent session material. Fleet therefore cannot claim who receives access, enumerate effective permissions, or offer a revocation control.
GranteeNot represented
Capabilities—
RevocationNot exposed
—
Governance
Approval and purpose
Operational reason
—
- Approval reference
- —
- Checkpoint
- —
—
Immutable request
Control-plane evidence
- Command-envelope hash
- —
- Grant ID
- —
- Concurrency rows
- —
CLI parity
Read authority status
Supply your configured SaaS URL and Firebase token outside Fleet.
——Authority activity
Support-grant lifecycle evidence
CoverageResolving
Final outcomeResolving
Redacted fieldsResolving
Loading current lifecycle evidence…
No support-access events are available.
Current grant state is available, but lifecycle evidence could not be loaded.
New support access grant
Constrain the device session before delegating.
Preview is read-only. Queueing locks the authority-normalized target, coarse scope, route, approval, expiry, and concurrency rows.
Authority preview
—
- Target
- —
- Route / scope
- —
- Approval
- —
- Expires
- —
- Target state
- —
- Envelope hash
- —
- Concurrency rows
- —
- Preview audit
- —