What you get
The console, the numbers a morning starts with, and the evidence a compliance review asks for.
On this page
One console, reading the backend over live subscriptions — a query is a subscription, so a fleet view updates as snapshots arrive rather than when somebody reloads.
The numbers a morning starts with
Three rows sit above every group in the navigation, because they are what somebody opens the console for:
| Home | what the estate is doing, over one window that every timed figure on the page follows |
| Events | what happened, newest first: a control transition, an unsanctioned tool, a device gone silent, a snapshot quarantined |
| Requests | the shorter list of what will not happen until somebody decides |
Requests is the one page that removes software from people's machines, and it is built to make that deliberate and reversible: one row per application rather than per detection, approval that is standing rather than broadcast — so an offline laptop is remediated when it returns — and a Stop removing that genuinely halts the spread to machines that have not polled yet.
The estate, and the folds across it
Surfaces is the roster: every enrolled machine, its posture, when it last reported, and the device record behind each row.
Monitoring is one row per thing, folded across however many machines carry it — applications, agentic tools and how autonomously each is configured to act, MCP servers and how many machines hold a credential for each, and skills: the packaged instruction sets that are the quietest way capability enters an estate, since a repository ships one and every enrolled machine's agent will run it on request, with no installer and nothing an application inventory can see.
What it costs
Token cost by model, provider, project, repository, application, agent and person. Three things about the arithmetic, because they are the reason the figure can be quoted:
- The device reports tokens, never money. A stale rate table embedded in an agent would report confident wrong money across a whole fleet.
- The backend prices at read time against a versioned rate table refreshed daily, so history can be re-priced.
- Rankings are by tokens, not cost. A provider whose rates are unknown has no cost to sort by, and a cost ranking would sink it to the bottom — exactly where usage you have not accounted for must not go.
It is called token cost, never "spend". And where you enter what you actually pay per tool, the console compares that against the API-equivalent cost of the tokens consumed — the unused-seat question. It reports the arithmetic and refuses the recommendation.
What a compliance review gets
| Regulations | framework controls — SOC 2 CC6.8, CC9.2 and the rest — evidenced by real signals rather than a hard-coded framework list. Four states as four columns, Unevaluated its own column |
| Remediations | a change, its scope, and the evidence that will show it worked, so closing one is a verdict changing rather than a box ticked |
| History | what the rules used to say and when they changed, so "the evidence changed" can be told from "the policy changed" |
| Evidence packs | an audit artifact for a period, built from a separate safe projection — chat, session titles, serials and per-device browsing detail are absent structurally, so no role can widen it |
| Nightly export | one NDJSON file per day of that projection, to an S3-compatible endpoint, for retention beyond the serving layer |
Reading raw evidence is audited: an access-log row is appended before any bytes return, and there is no reusable signed URL.
The console is described view by view in the full documentation.