🔑 Operators, agent keys and audit

A few screens still read demo data in places; see Known gaps.

Who can reach the FleetOS Manager, how an AI agent signs in, and the read-only record of what happened. Operator CAs are their own task: see Managing operator CAs in the web UI.

Operators

The operator certificates the manager knows about: recorded ones and ones it has only seen logging in, with their holder, level, kind, operator CA, serial, expiry, whether they are denylisted or CRL-revoked, and when they were last seen. A Pending requests tab lists the credential requests waiting for a signed certificate. The page needs an operator CA (see The operator CA and revocation). Without one it says no operator CA is configured.

admin gets Request credential…, Record certificate…, Complete… and Cancel on a request, and Deny… on a credential. Each is a step in Adding operators. Deny… puts a certificate on the manager's denylist: the manager refuses it from its next request. It needs database_url.

Denying here doesn't revoke at your CA

The denylist stops the certificate at the FleetOS Manager only. Revoke it at your operator CA as well and publish a new CRL.

The manager doesn't issue operator certificates: your operator CA signs them. To add an operator, see Operator credentials after day zero. Certificates the manager recorded before operator CAs became external are listed as legacy_node and can't log in.

Someone with no operator certificate yet can make their own key and CSR from the start page: No operator certificate yet? Make a credential request opens Make a credential request, which runs entirely in the browser.

Agent keys and MCP sign-in

When the manager's MCP endpoint is on, AI agents use agent keys. Each key is bound to the operator certificate that made it, and does no more than that certificate's level or its own ceiling, whichever is lower. It stops working when the certificate is revoked or renewed.

• Create key… makes a key for a client that can't open the browser sign-in. It is shown once; the manager keeps only a hash.
• Revoke… ends a key on the agent's next request.
• An MCP client's sign-in opens Authorize an MCP client in your browser, where you choose a level ceiling and Approve or Deny.
• Approvals lists the requests agents raise before a tool that changes the fleet runs, with a count of pending ones in the bar. Deciding them is its own task: see Approving agent requests.

The manager's MCP guide covers setup.

Audit

Every recorded event: time, kind, target, actor (a certificate or an agent key), how it came in, outcome and summary. It is read-only.