Run Oktsec Node where your agents work. Use Cloud to manage policy, review reported activity and prepare evidence for your security and compliance workflows.
Connect the agent workflows you want to govern to Oktsec Node. Manage their policy, reporting and review through Oktsec Cloud.
Policy, review and reporting
Requests an action
Apply policy · record evidence
Executes the action
Coverage follows the integration: requests that bypass the configured gateway, proxy, wrapper or hook are outside its enforcement and action evidence. Destination tools and model providers retain their own data flows.
A support agent needs checkout logs to diagnose failed requests. Route its MCP tool calls through Node and allow the read tool. Keep the restart tool outside that agent’s permissions.
Agent access: read checkout logs. Production restart: restricted.
Other Node checks still apply. If forwarded, the log service enforces the account’s read access.
The restart tool is not on the agent’s allowlist. The gateway rejects the call before forwarding it.
Review Node’s access decision alongside the destination’s logs. A denied call establishes that this route was blocked; it does not establish what happened through another route.
Use credentials limited to the required logs. If the agent can reach the service directly, that path needs its own controls and records.
Configure the agent’s tool allowlist for the read operation and confirm that the restart operation is excluded. Check the caller identity, routing, destination credentials and the policy actually applied by Node.
Exercise both calls in a test environment. Inspect Node’s decision and the backend invocation records. Also test direct access and Node unavailability; do not assume the client fails closed. Export only the evidence available for that integration and record any gaps.
This example describes the configured MCP gateway path. It is not a recorded test result or a claim of integration with a particular agent platform.
Agree on collection and review requirements before rollout. Routine reporting is reduced; an approval workflow needs the context of the action being reviewed.
| Workflow | What Cloud receives | What to review |
|---|---|---|
| Policy and system state | Cloud receivesSystem identity, software and configuration state, reported inventory, policy assignment and evidence health. | ReviewEnable the inventory and reporting capabilities needed for the systems in scope. |
| Routine activity and action receipts | Cloud receivesAgent or principal identifiers, decisions, rule metadata, timestamps and integrity records. Action receipts carry request and response hashes. | ReviewRoutine activity omits message bodies and tool arguments. Evidence can still identify systems, agents and resources. |
| Workstation baseline | Cloud receivesReduced control statuses, recognized provider identifiers and screen-lock timeout in a signed snapshot. | ReviewBaseline reporting must be enabled. The baseline block does not include filesystem paths or a full application list. |
| Quarantine and step-up review | Cloud receivesCredential-redacted quarantine messages and full tool arguments for step-up approvals. | ReviewThese review items can contain business information. Agree on reviewer access and handling of the context sent to Cloud. |
Use the observations already collected by Node and organized in Cloud to prepare evidence for SOC 2, ISO 27001 and internal reviews. Give the reviewer a system, an owner, an observation time and a record to examine.
Review eight checks across enrolled workstations: seven host observations from Node and device ownership recorded in Cloud. Find failed and unobserved controls by system or group.
CSV · systems, owners, controls and observation datesReview coverage, policy state, exceptions, activity and change history for a selected group and period. Report sections include references to relevant SOC 2 and ISO 27001 controls.
Markdown · review periods of 30, 90, 180 or 365 daysExport recorded activity and administrative changes. Use a signed action-evidence bundle when the reviewer needs to verify node identity, signatures and the included action lifecycle.
CSV / JSON exports · independently verifiable action bundlesFor a broader handoff, an organization owner can also download a ZIP of systems, policies, members, alerts and audit/activity records, with a manifest identifying export limits.
Enable baseline reporting for the workstations in scope. Unsupported or unreadable checks remain unobserved; non-applicable systems are excluded. These eight checks are Oktsec’s workstation baseline, not the complete SOC 2 control set.
Export from Oktsec, select the records for the review period, and attach them to the relevant controls in your compliance platform or auditor workspace. Review file format, access and scope before sharing.
This is an export-and-upload workflow. Vanta and Drata support custom evidence uploads; a native Oktsec connector is not currently provided.
Oktsec provides supporting evidence. Your organization and auditor determine the applicable controls, sufficiency of evidence and audit outcome.
Export the action-evidence bundle and check it against the enrolled node identity. The verifier reports signatures, lifecycle chains and the coverage of the included records.
Export the action-evidence bundle for the node and period under review from the control plane.
Obtain the enrolled node fingerprint through a trusted channel, independently of the bundle. The node reports it with oktsec node status.
Use the Oktsec Node verifier to check signatures and lifecycle chains, then review the reported coverage and completeness.
Use the Oktsec Node build supplied with your deployment. Obtain the trusted enrolled node fingerprint independently of the bundle.
# Verify an exported action-evidence bundle with the trusted node identity oktsec verify action-evidence \ --file ./action-evidence.json \ --expected-node-fingerprint '<trusted-node-fingerprint>' # Machine-readable verification result oktsec verify action-evidence \ --file ./action-evidence.json \ --expected-node-fingerprint '<trusted-node-fingerprint>' \ --json
Verification establishes the integrity of included records. Review export limits and completeness separately; a valid signature does not establish that every action was captured.
Start with a defined group of systems and the evidence your security, engineering and compliance teams need.
Identify supported agent integrations, outbound endpoints, system owners and the Node installation channel supplied for your deployment.
Assign policy, confirm its application and exercise allowed, held and blocked actions. Enable workstation baseline reporting where it applies.
Check reported coverage and missing observations. Prepare the policy report, baseline export and action evidence needed for your review.
No. Node initiates outbound connections to retrieve signed policy, send evidence and poll review decisions. Cloud does not open a remote shell. Configure the required endpoints and network access for the deployment.
No. Enforcement and action evidence cover the configured gateways, proxies, wrappers or hooks. Direct routes around those integration points must be reviewed separately. Workstation baseline observations are a separate reporting capability.
Routine event exports omit message bodies and tool arguments, and action receipts use hashes. Central review is different: quarantine items include credential-redacted message content, and step-up approval items include full tool arguments so the reviewer can approve the exact action.
Yes, through an export-and-upload workflow. Select the report or export for the systems and period under review, then attach it to the relevant control in the destination platform. File support and audit requirements depend on that platform.
No. Offline verification checks an exported action-evidence bundle with a trusted node identity. A fully disconnected control plane is a separate deployment mode and is planned.
Bring your agent workflows, network requirements and audit evidence needs. We will define the integration, reporting scope and first rollout with your team.
