Projects, host groups, and hosts
Structure resources into tenant, project, host-group, and host boundaries.
Tenvyr uses this hierarchy:
Tenant
└── Project
└── Host group
└── HostProjects
Projects organize related host groups. Use names that remain meaningful in
audit exports, such as Customer platform, Corporate IT, or Data services.
Host groups
A host group is both an authorization target and an SSH CA boundary. Split groups when systems should not share certificate trust.
When creating a host group, choose an offline mode:
| Mode | Behavior |
|---|---|
| Strict | Certificates only; no static-key fallback |
| Bounded | Compatibility keys/accounts retain an enforced expiry |
| Persistent | Last-known static access remains until connectivity returns |
Persistent mode is an explicit fail-open compatibility choice and should remain visible in risk review.
Managed local accounts
Managed-account creation is off by default. When enabled, the agent can create accounts it owns through typed desired state. It does not take over or delete a pre-existing account with the same name.
Hosts
Each successful enrollment creates one host identity with:
- an agent mTLS identity;
- reported operating system and architecture;
- a host-key set and revision;
- desired-state and applied-state revisions;
- last-seen health; and
- immutable enrollment evidence.
Disable a host when its identity, storage, ownership, or host keys can no longer be trusted. Re-enrollment should create a new reviewed identity rather than mutating the old record.