Managed Control Plane
Oten operates the control services. The customer owns endpoint rollout, resource onboarding, Gateway placement, identity integration, policy configuration, and the responsibilities defined in the service agreement.
DEPLOYMENT OPTIONS
Choose where policy runs, where traffic flows, and who owns recovery.
The deployment model changes service ownership, key custody, data handling, availability engineering, and incident responsibility. Oten Access keeps those boundaries explicit before rollout begins.
System role: Customer platform team + Oten deployment owner
Evaluation depends on: Requires a responsibility matrix, data-flow review, failure-domain design, backup and restore plan, and verified component scope.
IDENTITYOten or enterprise IdPUser assurance
PDPAccess Control PlaneDecision + desired state
SOURCE PEPOten EndpointDevice evidence
DESTINATION PEPOten GatewayResource policy
RESOURCEPrivate applications & servicesScoped access
Three deployment decisions shape the operating model.
Self-hosted Control Plane
The customer owns control-service availability, state, signing and encryption keys, observability, capacity, backup, upgrades, disaster recovery, and incident response.
Distributed Gateway Data Plane
Gateway Data Plane Groups run near protected resources. Versioned profiles define rollout scope, while explicit Failover Sets define compatible runtime takeover.
Shared responsibility is defined by system concern.
Identity and policy
Define the identity source, assurance requirements, role ownership, policy approvals, separation of duties, and emergency access governance.
State and keys
Assign custody, rotation, backup, recovery, and compromise response for signing keys, encryption keys, device credentials, service credentials, and durable state.
Endpoint and Gateway
Own supported versions, staged rollout, health monitoring, rollback, platform prerequisites, certificates, resource routes, and local failure behavior.
Signal and Relay
Plan regional reachability, authentication, capacity, network policy, metadata handling, and failure behavior without treating Relay as the resource enforcement point.
Audit and privacy
Define collected fields, purpose, access control, export, residency, retention, legal basis, deletion, and incident handling.
Support and recovery
Name alert owners, escalation paths, maintenance windows, recovery objectives, compatibility windows, and the evidence required to return to service.
Control availability and application-path availability fail independently.
- A Control Plane outage can preserve only signed, bounded last-known-good authority within its lease.
- Signal loss affects coordination and path establishment, not existing application payload by definition.
- Relay loss removes the encrypted fallback path; it does not change Gateway into a relay.
- Gateway takeover occurs only among compatible members of an explicit Failover Set.
- A failed rollout remains distinct from an active configuration and must have a tested rollback path.
- Expired trust, policy, or authority converges toward the configured restrictive state for the affected resource.
A deployment evaluation should leave a reproducible evidence pack.
- Component inventory, exact versions, operating systems, protocols, and resource modes.
- Data-flow and trust-boundary diagram with ownership for every credential and key.
- Backup, restore, upgrade, rollback, and incompatible-version tests.
- Gateway rollout, explicit failover, partial-failure, and last-known-good expiry results.
- Signal and Relay reachability, capacity assumptions, and direct-path fallback observations.
- Audit export, retention, access-control, privacy, and incident-communication verification.
Next in Oten Access
Continue the technical evaluation.
Turn deployment choice into an owned operating model.
Define the exact responsibility, failure, data, and recovery boundaries before selecting a rollout sequence.