Experience and status
Presents current trust state, available resources, remediation, policy version, local enforcement status, and degraded or recovery conditions.
OTEN ENDPOINT
Turn device evidence into enforceable access context.
Oten Endpoint observes relevant device signals, qualifies posture for policy use, maintains durable local state through ogc-core, and coordinates source-side enforcement services for access and endpoint protection.
System role: Endpoint-side Policy Enforcement Point
USEREndpoint experienceTransparent state
BOUNDARYSecure IPCAuthorized methods
LOCAL CONTROLogc-coreDesired state · Reconciliation · LKG
ENFORCEMENTEndpoint-owned servicesSeparately supervised
PLATFORMNative adaptersOS-specific
ENDPOINT LOCAL AUTHORITY
One endpoint platform coordinating distinct services.
Oten Endpoint separates the product experience, the durable Oten Endpoint Local Control Plane, and endpoint-owned enforcement services. Shared context does not flatten their authority boundaries.
Oten Endpoint Local Control Plane
ogc-core owns durable local intent, desired-state reconciliation, last-known-good state, and coordination of endpoint enforcement services.
Endpoint enforcement services
Separately supervised processes apply network, posture, and security actions using native operating-system controls for their defined scope.
DEVICE EVIDENCE PIPELINE
Raw observations do not become trust claims automatically.
Oten distinguishes observation from qualified posture. Source, freshness, relevance, device binding, policy version, and missing or conflicting state determine whether evidence can enter an access decision.
- 1Observe→
- 2Normalize→
- 3Qualify→
- 4Version→
- 5Decision context
FreshStaleMissingConflictingRejected
Observed evidence
A named endpoint source reports a value with an observation time and device binding. Observation alone does not produce a permitted state.
Qualified context
Evidence is evaluated for source, freshness, relevance, conflicts, and current system state before policy can use it.
Privacy boundary
Use derived or qualified context where possible so policy receives the minimum information required for the named decision.
Modules share context while preserving separate authority.
Device Trust
Enrollment, device identity, posture, group policy, resource-aware trust, and explainable Health Score inputs.
Explore Device Trust →ZTNA / private connectivity
Encrypted overlay, internal DNS, resource routes, direct and relayed paths, and an explicit VPN mode where needed.
Explore connectivity →Endpoint Defense
Platform-native telemetry, common event schema, detection, and guarded access response.
Explore Endpoint Defense →Data Protection
Endpoint data-in-use controls for supported channels, coordinated with Oten Protector policy.
Explore Data Protection →PAM Agent
Device-trust-gated credential brokering and JIT privilege for supported operating systems and workflows.
Explore Privileged Access →The local control plane owns intent. Services own enforcement.
LAYER 01
User experience
Trust state, available resources, remediation, access requests, approval, and transparent offline or failure status.
LAYER 02
Agent API and secure IPC
Authenticated local control, least-privilege method surfaces, authorization per method, and an explicit event contract.
LAYER 03
Oten Endpoint Local Control Plane
ogc-core maintains local desired state, last-known-good state, reconciliation, module health, update, audit, and telemetry coordination.
LAYER 04
Module runtime
Connectivity, Device Trust, Endpoint Defense, Data Protection, and PAM logic with separate authority boundaries.
LAYER 05
Platform adapters
macOS ESF and Network Extension, Windows ETW/WFP/minifilter, and Linux eBPF/LSM/TUN where required.
LAYER 06
OS trust and storage
Secure Enclave, TPM, Keychain, DPAPI, keyring, code signing, system services, and platform update trust.
Device lifecycle includes degraded and recovery states.
Install
Install signed software through an approved distribution and update channel.
Enroll
Bind the device to the organization and a distinct device identity.
Qualify
Receive signed policy, observe posture, and expose evidence freshness and reasons.
Enforce
Apply resource policy, local controls, and bounded cached authority.
Maintain
Update with signature verification, staged activation, health checks, and recoverable rollback.
Restrict or quarantine
Preserve approved management paths while explaining blocked resources and remediation.
Revoke or decommission
Invalidate the device authority and record the final state independently from enrollment credentials.
- Unenrolled or pending approval
- Enrolled and verifying
- Connected and compliant
- Restricted with remediation required
- Quarantined or revoked
- Offline with bounded last-known-good policy
- Update failed and rolled back
Endpoint security depends on explicit local boundaries.
- Use hardware-backed, non-exportable keys only where platform support and enrollment evidence justify the claim.
- Authorize secure IPC per method; never treat local process presence as authority.
- Verify signed policy and configuration, audience binding, version, validity, and rollback protection before activation.
- Keep module privileges separate and preserve restrictive, signed last-known-good enforcement during bounded orphan operation.
- Fail closed for critical resources when policy requires it, while showing a safe reason, last sync, and remediation path.
- Verify update signatures and support an observable, recoverable rollback path.
FAQ
Questions security and platform teams ask first.
Does a unified Agent increase blast radius?
It can if module privilege, IPC, policy, signing, update, and rollback boundaries are vague. Oten uses a shared core to reduce duplication, but the architecture must keep module authority and platform-specific enforcement explicit.
Is the Linux Agent identical to the desktop Agent?
No. Headless Linux journeys prioritize Setup Key bootstrap, service lifecycle, resource connectivity, and server-appropriate posture. Interactive desktop UI and browser-based enrollment are not defaults for every server node.
How does policy work while the Agent is offline?
The Agent may use signed, versioned cached policy within a bounded lease. Critical resources can fail closed when trust or policy expires. The user experience must show the last successful sync, expiry, and current enforcement state.
Next in Oten Access
Continue the technical evaluation.
Start with a trustworthy device foundation.
Understand enrollment, evidence quality, trust state, and the endpoint-side enforcement boundary before adding deeper security modules.