How Tenvyr works

Understand the control plane, direct SSH data path, short-lived certificates, and outbound-only host agents.

Tenvyr separates the authorization plane from the SSH data path.

                    authorization + certificate
Engineer ─────────────────────────────────────────> Tenvyr
    │                                                   ▲
    │ direct system OpenSSH                             │ outbound state
    ▼                                                   │
Managed host <────────────────────────────────── Tenvyr agent

What stays direct

Interactive SSH traffic flows from the user’s system OpenSSH client to the target host. Tenvyr does not proxy terminals, record shell contents, or become a network hop for the session.

What Tenvyr governs

Tenvyr determines:

which tenant identity may request access;
which project, host group, host, and local account are in scope;
whether access is immediate or requires one or two independent approvals;
the maximum grant and certificate lifetimes;
which credential and privilege profile are required;
what SSH trust and revocation state the host should enforce; and
which audit evidence is created for every transition.

After an approved grant, the CLI proves possession of the enrolled SSH key with a one-use OpenSSH SSHSIG challenge. Tenvyr then issues a host-group-scoped user certificate with a maximum lifetime of ten minutes.

The private key never leaves the user device. A lost response can be retried without issuing a different certificate for the same signing job.

Outbound-only agents

Each host agent:

generates its mTLS private key locally during enrollment;
opens outbound HTTPS connections to https://agents.tenvyr.com;
validates signed, host-bound, typed desired state;
rejects replay and downgrade;
applies changes atomically and validates OpenSSH before activation; and
reports health, host keys, and convergence evidence.

The agent exposes no inbound Tenvyr listener.

Trust boundaries

Every host group has a separate SSH user CA. Keep separate host groups for systems that should not accept the same user certificates—for example, development, production, regulated workloads, and administrative bastions.

Revocation and convergence

Containment revokes future certificate issuance immediately and publishes revocation state for agents to reconcile. Existing direct SSH sessions cannot be forcibly terminated by Tenvyr; use operating-system or network containment when an already-open session must be stopped.

Compatibility access

Tenvyr can also reconcile static authorized keys for systems that cannot yet use certificates. This is an explicit compatibility mode with more standing-access risk. Prefer short-lived certificates for normal human access.