Architecture
Control Plane Decision
How the decision area interacts with identity, resource, assignment, and policy inputs before a session opens.
The control plane owns the decision for a new CerberusD session. A signed-in person, a visible resource, or a ready connection path does not open a work surface by itself. Identity, scope, and assignment defines the decision inputs; this page describes the responsibility boundary between areas.
Interaction between areas
| Area | Information supplied to the control plane | Result produced by the control plane |
|---|---|---|
| Identity and assignment | Person, workspace, role, resource, and duration relationship | A scoped decision candidate |
| Resource/agent plane | Resource record, last-seen, readiness, and connection signal | Resource suitability for the session |
| Session gateway | Active-session and work-surface state | Conflict or existing-work information |
| Policy and evidence | Duration, session restrictions, prior decisions, and closure context | Open/closed decision and reviewable event |
Decision boundary
An allowed decision creates only a narrow work context for the person, resource, scope, duration, and session. The session gateway validates that context again within its own boundary. The control plane does not fill in missing resource signals; the gateway does not widen a closed decision into general access.
Failure behavior
- A missing identity, workspace, or assignment match keeps the decision closed.
- A stale, offline, or quarantined resource does not receive a new launch decision.
- A duration or session-policy restriction keeps the work surface closed.
- An active-session conflict remains a distinct conflict result.
- Connection or termination failures after launch follow Failure and revocation.
Missing state does not produce a broad fallback. A retry creates a new decision from current resource, assignment, and policy state.
Records
The decision result enters the evidence flow with person, workspace, resource, assignment, readiness, and policy context. The same record explains both opened and denied launch attempts.