Tunnel Command

Where the organization exercises authority, and only authority.

Tunnel Command is the native environment in which an organization governs its own communication: who is enrolled, which devices are trusted, which missions exist, who may communicate with whom, and when that permission ends. It governs the authorization structure the customer created. It is not a window into what people say.

  • Native desktop
  • Customer-controlled
  • No content access
  • Signed distribution

Administration

A native administration environment for the organization.

Command governs communication authority. It does not possess content keys or plaintext, and it does not observe message activity.

GOVERNS

Devices

Enrollment, certificate issuance, replacement and withdrawal.

GOVERNS

Missions

Creation, governance and closure as first-class objects.

GOVERNS

Directional relationships

Each authorized path issued explicitly, in one direction.

GOVERNS

Messaging authority

Who may exchange messages, with whom, until when.

GOVERNS

File authority

File exchange authorized separately from messaging.

GOVERNS

Voice and video authority

Live call capability authorized separately again.

GOVERNS

Mission rooms

Group scope governed as part of the mission, not as a contact list.

GOVERNS

Expiration

Every authorization carries a signed validity window.

GOVERNS

Revocation

Effective when the device receives newer signed state, or at expiry.

GOVERNS

Policy epoch

Advances when the rules governing a mission change.

GOVERNS

Delivery epoch

Rotates the addressing under which material is carried.

GOVERNS

Identity epoch

Advances when a device's standing changes.

GOVERNS

Audit

Administrative actions recorded, with no message content in the record.

GOVERNS

Role separation

Administration and audit held by different people, enforced.

GOVERNS

Signed policy

Policy and software reach devices under signature.

The product

What an administrator actually sees.

Authentic captures from the product's own visual tests, against synthetic data.

Tunnel Command missions view showing a mission with policy, delivery and identity epochs, and seven separate administrative roles.
Administrative authority is separated into distinct roles, and the three epochs are labeled independently rather than collapsed into one version number.
Tunnel Command audit view stating that the record holds administrative actions only, and that the audit role cannot be held with a role that acts.
The audit record holds administrative actions only, by schema rather than by filtering, and the role that reads it cannot be held by a role that acts.

Functions

What an administrator does here

Command exists so that the answer to 'who decided this person may communicate?' is a record inside the customer's own domain.

01

Organization administration

Roles, separation of duties and the administrative boundaries that determine who may exercise which authority.
02

Operator enrollment

Bringing people into the deployment under the organization's own authority, with an auditable record of who authorized it.
03

Device enrollment and replacement

Binding a device to an operator, and replacing a device without re-establishing the operator's standing.
04

Mission and compartment administration

Creating missions, defining compartments and setting the operational boundaries within which communication is permitted.
05

Communication-authority issuance

Issuing directional, capability-scoped, time-limited authority for a specific operational context.
06

Device revocation

Withdrawing a device's authority independently of the operator's other devices.
07

Credential expiration

Authority that ends on its own, so that permission is not something the organization has to remember to remove.
08

Policy and transport policy

Which capabilities are enabled, which transports are permitted and under what conditions communication may be carried.
09

Relay administration

Configuring custody behavior, priority classes, retention and expiration enforcement on the relay infrastructure the organization operates or subscribes to.
10

Controlled audit review

Reviewing the administrative record of who issued, changed or withdrew authority, and when, within the customer's own audit domain.
11

Incident coordination

Acting on a lost device, a compromised operator or a mission that must be closed, and confirming that the action took effect.
12

Signed software and policy distribution

Distributing signed application builds and signed policy under the organization's control, including where the deployment is offline.

The boundary

Command governs communication. It does not read it.

This is the invariant the whole architecture is built to hold. The mission authority signs assertions about who may communicate. It holds a signing key, and a signing key cannot produce a key agreement.

  • The mission authority holds an Ed25519 signing key. It has no key-agreement or decapsulation surface at all.
  • Payload keys are derived on the endpoints from an X25519 agreement combined with an ML-KEM-768 encapsulation. The issuer of an authorization contributes no input to that derivation.
  • Adding a signed authorization to a bundle changes what a relay may refuse to carry. It never changes what a relay may read.
  • No administrator, Command instance or operator of the platform gains a plaintext capability by issuing or enforcing authority.

The authority that permits communication does not possess the keys required to decrypt communication.

Authority model

Permission is scoped, directional and finite.

Authority in Tunnel is issued for a mission, in a direction, for a capability, for a period. Nothing about it is ambient, and nothing about it is permanent by default.

Accountability

Customer-controlled, and therefore answerable to the customer.

In a sovereign deployment the administrative record lives in the customer's own audit domain. The organization does not have to ask a vendor what its own administrators did.

Next step

Walk through Command with your governance model in front of you.

An executive briefing covers role separation, mission structure, the authority lifecycle and how the administrative record works in your deployment.

Request an Executive Security BriefingTunnel Relay