Administrators log in to the gateway, not to the target machine. The certificate that grants access is created at the moment of the request, lives for five minutes and never leaves the gateway's memory. There is nothing to steal from a workstation and nothing to forget to revoke — removing someone from the directory takes effect immediately.

Every command is evaluated against policy before it reaches the server: allow, require approval, or deny. A blocked command never starts — you don't find out afterwards from a recording. The built-in denials — interactive root shell, destructive system deletion — cannot be overridden; everything above that layer is freely configurable.

Two complementary records are produced, both on the gateway: a structured command log (searchable, alertable, ready for your SIEM) and a time-accurate recording of the full interactive session. The log is written where the attacker isn't — a root user who breaks into a target machine cannot reach the record of what they did.

A command awaiting approval waits on the gateway: nothing runs on the target machine until the decision is made. The decision, the approver and the timestamp stay in the audit log and linked to the ticket. Every access above the configured threshold opens a JIRA ticket — even when no approval was required.

The dashboard shows who is logged in where, and since when. Any session can be terminated from the outside with a single action — response time drops to minutes, and none of it requires anything installed on the target machine.