WORK ARCHITECTURE
The resource stays in its own environment. Cerberus manages the connection path, browser work surface, and protected credential handoff in one session context.
Explore connection models01 / CONNECTION MODELS
Each model contributes different readiness and reachability signals. The responsibilities that stay in the resource environment remain explicit.
02 / BROWSER RUNTIME
CerberusLite projects desktop and terminal capabilities into the browser together with the effective session policy.
A Windows desktop session opens in the browser work surface.
The VNC display and input scope run in the same browser shell.
The command line and optional file transfer project into a browser terminal.
A Kubernetes terminal joins the managed resource and session context.
03 / OPTIONAL WINDOWS AGENT
The Agent path serves deployments that need richer readiness and health signals from a Windows machine.
The Agent is optional. Private-network Gateway and existing approved paths operate as separate connection models.
04 / CREDENTIAL CUSTODY
While the operator works in the browser, target credential material travels through the protected handoff path to the protocol runtime.
The operator uses the desktop or terminal surface while the target secret remains on the protected session path.
Protected material is handed off only for the selected target and authorized session context.
Credential material required by the connection is processed on a work path separated from the user surface.
TECHNICAL REVIEW
Review where the resource stays and which boundary the connection path crosses.
See how the target secret is protected along the work path.
Review the closure flow when readiness or session state changes.
Evaluate identity, network, endpoint, and record responsibilities.
See the portal and RDP work surface in the demo or continue to the technical documentation.
