Broad VPN access
Can give more network reach than the task needs.
Cerberus ties access to resource, assignment, and session decisions.Governed Operations Plane
What is Cerberus?
Cerberus is a Governed Operations Plane for desktop and terminal work by teams and AI workers. PAM (privileged access management) controls govern resource access with time limits, required session approval, revocation and audit records.
Zero Port01Machine connects
02Resource assigned
03Decision made
04Session opens
05Access closes
06Record remains
Why does this need a product?
Governing work means defining who can use which resource, under what authority, who approves when required, and how the result is reviewed. Cerberus keeps those decisions in the same operating context.
Direct remote desktop
Can turn a machine into a standing reachable target.
With Zero Port, the resource port does not become the work target.Shared password
Makes it difficult to read who worked and when.
Work opens in a browser session and leaves an evidence record.The Cerberus operating model
Resource, decision, work, closure and evidence belong to one governance model. RDP, SSH, VNC, terminal and Kubernetes are supported work paths within that model.
Resource
An existing computer or terminal stays in its environment and becomes a governed resource through the Windows Agent, a suitable gateway or a defined access path.
Decision
Identity, role, assignment, readiness, duration and required approval by authorized users are evaluated together before work starts.
Session
The working surface is delivered to the browser screen without establishing a direct network connection between the user and the resource machine.
Closure
When an assignment ends, new sessions cannot launch. Check active sessions separately; termination depends on the protocol and deployment model.
Evidence
Permission, session, revocation, and result remain visible in one record.
Zero Port
What does Zero Port mean?
With the Windows Agent secure connection or a private-network gateway, resource ports stay away from direct user access. Users reach assigned resources through the browser. For manual or existing network paths, ports, firewall rules and network exposure remain the deployment team's responsibility.
What does one job look like?Cerberus
ResourceFinance computer
Ready inventory resource
AssignmentMaintenance task
Specific user and scope
SessionOpen in browser
Display, input, and clipboard limits
ClosureRevoke access
New work needs a new decision
RecordView record
Who, which resource, which result
What remains after work ends?
The record is not a raw log dump. It keeps who worked, which resource was involved, which decision applied, and how work ended in a readable form.
Explore PAM controls and scopePermission decisionDid user and resource match?
Session traceWhen did work open?
ScopeWhich boundaries applied?
ClosureHow did access close?
See Cerberus in the product flow
Start with the live demo surface, then read how resource, work, closure, and records stay in one governed flow.