Changelog

A new admin report shows, per zone, permission group and access level, what the matrix stores and what the system actually grants — the two are not always the same. The report can be exported to CSV, so it can also serve as evidence to hand over.

The service now watches the rate of incoming requests. Ordinary use is not affected; only under sustained heavy load, or from a client that misbehaves, can an occasional request be temporarily declined — so the system stays available for everyone else.

An access grant can be revoked. The system offers to close the running session on the target, a reason is mandatory, and the decision reaches the user's notification bell — together with why.

A report of who signed in at the Justification required grade, when, and with what justification. Periodic access review no longer has to be assembled from interviews.

The tunnel connector can now build the path to the target server over an OpenVPN connection as well, with .ovpn import. The tunnelled listener never binds to 0.0.0.0 or a LAN address.

The tunnel connector can also reach target servers over a Fortinet SSL-VPN connection, under the same security constraint as the OpenVPN path.

Access to an Approval required target starts with a request: the user sets the planned start time, an approver grants or denies it, and the connection opens only after approval. If nobody decides, there is no access — there is no workaround.

A user's own request never appears on their own approval queue — someone else must decide it. The requester learns of the grant or denial through the notification bell.

Every access decision comes from the zone matrix cells: the resulting grade is the highest value across the caller's groups' cells, and a missing cell means Denied — never an implicit allow.

Signing in to a Justification required target asks the user for a reason. One click is one justification within a session — the system does not ask again for the same connection.

The server-list tiles show which targets are in the Justification required grade before the user clicks.

The client updates from your own network share. A release now never overwrites a running file: the new version lands alongside the old one and only becomes active once it is fully in place. So a session that is already open is never broken by an update in progress, and a half-replaced program cannot occur.

Every release now ships a CycloneDX-format SBOM (software bill of materials) as a Release attachment, listing the components in use.

SSH targets now open in an embedded terminal window inside the client, with no password or key stored on the machine — the Broker resolves the secret, the client never sees it.

An unknown SSH host key prompts a clear accept/reject decision, and the decision is logged. The connection uses certificate pinning, including over the WebSocket path.

The server-list tab can switch between a matrix view and a flat tile view; the choice is remembered per user in the settings.

The tile view is built on a virtualised canvas, so scrolling and rendering stay fast even with a large number of servers.

The Broker is installed through a self-contained seven-step wizard: prerequisite checks, SQL provisioning, certificate selection from the machine store (with a self-signed fallback), and a closing smoke test on the service, the health endpoint and the database.

The installer creates a passphrase-protected recovery package for the encryption key, and rolls back a failed save while preserving the error chain.

The full-screen header bar now has an icon that moves the session to the next monitor without dropping the connection.

The entire client is now available in English, with the language switchable per user.

A running session on an exclusive target can be offered to an authorised colleague, who accepts it from the notification bell. The handover is logged.