Oten Access terms, explained by their role in the system.

Also: authorization policy, resource policy

A versioned rule that maps subject, device, resource, and conditions to an action.

Oten evaluates WHO × DEVICE × RESOURCE × CONDITIONS × CURRENT SESSION to produce bounded authority and required enforcement behavior.

Also: device attestation

Evidence about platform or device state that can be verified by another party.

Claims are platform-specific. Hardware-backed storage or platform evidence does not by itself prove that enrollment was authorized or the device is currently compliant.

Also: backend control plane

A general term for service-side management, policy, and coordination systems.

Use the product-specific name Oten Access Control Plane whenever that exact service-level component is intended.

Also: authorization lease, connection lease

An access grant constrained by scope, lifetime, evidence freshness, and policy validity.

Allow never means permanent trust. Sessions, credentials, certificates, and connection paths expire or re-evaluate under explicit rules.

Also: emergency access

A controlled emergency-access path used when normal authorization or dependencies are unavailable.

Break-glass requires dedicated identity, strong authentication, narrow duration and scope, immediate audit and notification, and post-event review.

Also: Gateway profile, desired state

A versioned, signed desired-state artifact for Gateway listeners, routes, policy references, and operational settings.

Profiles are assigned to Data Plane Groups, staged and verified by nodes, then reported as active only after successful activation and health confirmation.

Also: enforcement confirmation

The recorded result showing whether intended enforcement took effect and what access state followed.

A distributed decision is not complete merely because it was issued. Required enforcement points report applied, limited, failed, pending, or unknown outcomes for the relevant policy version.

Also: continuous evaluation, closed trust loop

A closed evidence-to-enforcement system in which access remains bounded and revocable.

Qualified evidence drives a decision, bounded authority, Endpoint and Gateway enforcement, confirmation, and evidence-based recovery. A revoke command without acknowledgement does not close the loop.

Also: Gateway group

A set of Gateway nodes assigned the same Configuration Profile and rollout policy.

The group is a configuration and rollout boundary. Group membership does not automatically create takeover authority; eligible Failover Set members are selected explicitly.

Also: implicit deny

Access is denied unless an applicable policy explicitly authorizes the requested scope.

The default mental model is resource-, protocol-, port-, role-, and condition-scoped authorization, not broad network access.

Also: versioned desired state

The explicit, versioned state that a component is expected to apply.

The Oten Access Control Plane distributes desired state. Local components validate, apply, and confirm it according to their authority and continuity boundaries.

Also: Agent Node identity

A distinct cryptographic and organizational identity assigned to an enrolled device or server.

Device identity remains separate from user identity and posture freshness. Hardware-backed storage is claimed only where platform evidence supports it.

Also: takeover set

An explicit set of compatible Gateway nodes permitted to take over for one another.

Membership, health criteria, priority, failure domain, configuration compatibility, fencing, and session behavior are explicit. Deployment or group membership alone does not create takeover authority.

Also: evidence age, freshness boundary

The policy-bounded period during which evidence or state remains acceptable for a named decision.

Freshness is evaluated for a specific evidence source, resource policy, and system state. Stale evidence remains distinct from failed or missing evidence.

Also: Gateway installation

The administrative boundary for one Oten Gateway installation.

A deployment can contain multiple Configuration Profiles, Data Plane Groups, locations, and independent Failover Sets.

Also: data-plane node

One running Oten Gateway data-plane instance in a specific location and failure domain.

A node verifies signed configuration, enforces supported resource policy, reports health and audit, and participates in failover only when eligible.

Also: device health score

An explanatory aggregate of qualified posture and risk signals.

Health Score can inform policy and trends but cannot override mandatory gates such as revoked identity, invalid signature, expired authority, or a critical verdict.

Also: Interactive Connectivity Establishment

A framework for gathering and selecting network candidates for a peer-to-peer path.

Candidate coordination can help Oten nodes establish a direct encrypted path or determine that relay fallback is required.

Also: JIT access, JIT privilege

Access granted only when requested and limited to an approved scope and time window.

The Oten model combines identity, Device Trust, approval, resource and role scope, and short-lived credentials or certificates.

Also: LKG

The most recent signed, valid, compatible state known to have activated successfully.

An Endpoint or Gateway can preserve qualified existing enforcement from LKG within a bounded lease. It cannot create new authority while orphaned.

Also: overlay address

A private address assigned inside an encrypted overlay network.

The address helps route authorized traffic but is not identity, policy, or permission by itself.

Also: OIDC

An identity layer built on OAuth 2.0 that communicates authentication and user claims.

Oten native clients use the system browser, Authorization Code, PKCE, state, nonce, exact redirects, and token validation.

Also: service-level control plane

The service-level policy and desired-state authority for Oten Access.

It combines qualified access context, computes decisions, and distributes versioned state. It does not carry application payload.

Also: ogc-core

The durable local authority on an Oten Endpoint.

ogc-core persists local intent, reconciles desired and last-known-good state, and coordinates endpoint-owned enforcement services.

Also: Proof Key for Code Exchange, RFC 7636

A proof mechanism that reduces authorization-code interception risk for public clients.

PKCE is one control in the OIDC native-client profile. It does not replace redirect, state, nonce, token, session, or secure storage requirements.

Also: PDP

The component that evaluates context and policy to produce an authorization decision.

The Oten Access Control Plane acts as PDP and emits bounded decisions, reasons, scope, TTL, required PEPs, and re-evaluation conditions.

Also: PEP

A component that applies an authorization decision at a controlled boundary.

Oten Endpoint enforces at the source and Oten Gateway enforces near the resource. Each reports whether the requested action was applied.

Also: device posture check

A device evidence condition that must be satisfied for a particular resource or action.

A gate can evaluate evidence value, freshness, source, and platform support. Mandatory gates override a high aggregate Health Score.

Also: TURN relay, relayed path

A fallback forwarding service used when nodes cannot establish a direct path.

Relay forwards end-to-end encrypted data-plane packets and should not decrypt the application payload. It is not an Oten Gateway.

Also: enrollment key, bootstrap key

A bounded secret used to bootstrap enrollment for a headless or server node.

The enrolled node receives a distinct identity and key. Revoking a Setup Key blocks new enrollment but does not automatically revoke existing nodes unless an explicit action does so.

Also: Signal coordination

The coordination channel for control and connection-setup state.

Signal helps authenticated nodes exchange presence and path-setup information. It does not carry application payload and is distinct from Relay.

Also: Session Traversal Utilities for NAT

A protocol used to discover a node's network-facing address and NAT behavior.

STUN helps gather direct-path candidates. It does not relay application traffic or authorize a resource.

Also: WireGuard tunnel

A protocol for encrypted network tunnels between authenticated peers.

WireGuard protects the Oten data path. Resource authorization, device trust, route scope, and continuous decisions come from the surrounding Oten policy and enforcement model.

Also: ZTNA

Resource-focused access based on identity and context rather than implicit trust in network location.

Oten combines device evidence, resource policy, bounded encrypted connectivity, and Endpoint or Gateway enforcement. A tunnel alone is not ZTNA.