Accounts, devices and roles: who can do what

The whole picture

One laptop, three accounts. In your own account the laptop's console is an owner; in each customer's account it is an admin. The accounts never share a key, so one customer's data cannot be opened with another's.

The five words

Account: One signed log of who belongs to it and what they may do, and its own keys, made by its consoles. What its machines record is sealed to the consoles that may read it. Your own machines form one account. An account holds up to 10 machines; consoles do not count.
Customer: Simply another account, one your consoles also manage. It has its own keys, its own log and its own recovery paper, and needs its own three owner or admin consoles.
Site and group: Places inside one account: a site (an office, a depot) can hold groups (a floor, a team's machines). They decide how far a console's role reaches. Each site and group has keys of its own: a console placed in one site never receives the keys of another, so it cannot open that site's data even with a copy of everything the Dispatcher stores. Their names are sealed in the account log for the account's consoles: the Dispatcher and the witnesses see only their numbers.
Device: A console is one person's MoxiVue Console on one computer: the window and the moxivue command line, with that person's keys for the account. A machine is a computer the account looks after, running MoxiVue Agent. Consoles have roles; machines have none, and can never be an owner or admin. Every device makes its own keys for every account it joins.
Person: Each console belongs to a person, named in the account log when the console joins (a new person, or the inviting person's own); the name is sealed there, so the Dispatcher sees only a person number. Machines belong to no person. Signing in to the Dispatcher shows who you are; it holds no key and gives no role. What you can do comes from your console's role.

Four roles, each one step up, and auditors beside them

A role belongs to a console in one account. Each role can do everything the one before it can. An auditor stands beside them: it reads and never acts.

What it can do	Auditor	Viewer	Operator	Admin	Owner
See live data and faults of the machines it reaches	no–	yes	yes	yes	yes
Read stored history from its join on, and the whole account's log	yes	yes	yes	yes	yes
Open a terminal, a forward, a wake packet or an SSH session on machines it reaches, where the account allows it	no–	no–	yes	yes	yes
Play and export the session recordings of the machines it reaches	yes	no–	no–	yes	yes
Confirm sudo in a session it opened; ask a machine's root executor for a packet capture	no–	no–	no–	yes	yes
Ask a machine to update MoxiVue, from the window or the command line	no–	no–	no–	yes	yes
Invite consoles (a role up to its own; owners and auditors only by an owner), approve machines, issue install tokens	no–	no–	no–	yes	yes
Confirm another console's sensitive change	no–	no–	no–	yes	yes
Change a device's role, reach or place (never above its own; only owners touch owners)	no–	no–	no–	yes	yes
Remove a device (only owners remove owners; anyone may leave)	no–	no–	no–	yes	yes
Settings of the places it reaches; switch terminals and forwards on (a second console confirms) or off; switch SSH and per-person accounts off	no–	no–	no–	yes	yes
Add and rename sites and groups, name people and give consoles to them, remove a person with all their consoles (whole account)	no–	no–	no–	yes	yes
Switch on SSH to machines and per-person accounts on machines; grant an SSH key for up to 30 days	no–	no–	no–	no–	yes
Switch session recording off for a place and set how long recordings are kept (30 to 400 days)	no–	no–	no–	no–	yes
Make auditors, give a person the older history of their places, replace the recovery paper, delete the account	no–	no–	no–	no–	yes

Every one of these rights is checked by one rules core, the same code on every console, every machine and the Dispatcher, against the account's signed log. A machine re-checks the role, reach and state of the console that asks, at its own current view of the log, before every request and every 30 seconds during a session.

Auditors. An owner can make a console an auditor of the account, or of a site or group (it joins as one, and a second console confirms). An auditor reads the account log and stored history, and plays and exports the session recordings of its place. Machines refuse it live data and every kind of session, and it can propose or confirm nothing.

A second console confirms. A sensitive change (a new console, a new role or reach, settings, SSH, a new recovery paper, a removal) takes effect only when another owner or admin console confirms it: not the one that asked, not the one the change is about, and not one marked as automation. The confirming person compares what is shown, such as three words from the new console's screen. So a stolen console alone cannot add a console or raise a role. Confirming, inviting, approving a machine and opening a session also need the console to be unlocked with its computer's password: it stays unlocked 15 minutes, time asleep counts, and it locks with the screen.

An account starts in set-up

A new account takes no machine until it has three consoles that are owners or admins of the whole account, on three computers, two of them owners. Until then only such consoles can join. From then on any one of the three can be removed by the other two; if a removal leaves fewer than three, the account is in set-up again, and no new machine joins until another such console has.

Why three: with two, a stolen console and the person who lost it would have no one to break the tie. Three different computers matter: consoles on one computer, or computers carried together, can fall together, and the log cannot tell.

Where a role reaches

A console is placed in the whole account, in a site, or in a group inside a site. Its role then reaches only the machines of that place. An owner is always placed in the whole account.

A site admin in Dallas can approve machines and change settings in Dallas and its groups, and cannot open Austin's machines, read Austin's data or change Austin's settings. Every member can see the account log: its consoles, roles and places, and its site, group and people's names. It cannot give itself a wider reach.

Common setups

Just you

One account with three consoles of yours, for example your laptop, your desktop and a spare laptop, two of them owners. Then your servers and Pis join it. Keep the recovery paper somewhere safe: it is the way back in if you lose every console.

A service provider

Your own account, plus one account per customer, each with its own three owner or admin consoles. Your consoles can be owners or admins in each. A technician's console joins a customer as an operator, or as an admin of one site.

A technician leaves

An owner or admin removes the person, and all their consoles leave in one step once another console confirms it. Every place they reached gets new keys at once; machines stop sealing to the old ones within an hour, and machines end any session of theirs at their next check, every 30 seconds, and within that hour at the latest.

Planned

Hardware security keys, for confirming changes and unlocking the console. Until then a second console and the computer password do that, as above.

See also: privileged access (how sessions, sudo and SSH keys are approved and recorded), the security page and the protocol, and the first install for the steps.