Architecture
Architecture Overview
Summary of control plane, resource/agent plane, session gateway, and evidence plane responsibilities.
CerberusD architecture separates four product responsibilities. This page defines their boundaries; each linked page owns the detailed behavior.
Responsibility map
| Plane | State owned | Result produced | Deep dive |
|---|---|---|---|
| Control plane | Person, workspace, role, assignment, and session decision | Open or closed launch decision | Control plane |
| Resource/agent plane | Resource record, last-seen, health, and connection preparation | Current readiness state | Resource plane |
| Session gateway | Active RDP, VNC, SSH, terminal, or Kubernetes work surface | Running session, runtime policy, and closure | Session gateway |
| Evidence plane | Decision and session events | Reviewable lifecycle and result | Evidence plane |
Contract between planes
The resource plane produces readiness. The control plane evaluates that state with access context. The session gateway carries only an opened decision into a work surface. The evidence plane links every result under the same session context.
One plane does not guess missing or stale state from another. Failure and revocation covers failure behavior; Deployment responsibilities covers ownership between the team and managed service.
End-to-end order
Resource readiness → access decision → work surface → closure result
Use Session flow for the person-facing steps.