Every VPN peer, AD right, and admin login behind one rule — request, approve, time-box, log. No standing keys. No credentials by chat. On hardware you own.
Governed access for the estate you already run — Active Directory, WireGuard & FortiGate.
Nobody gets a key that lasts forever. Sentinel governs the full lifecycle — and closes it automatically.
Pick a server or role, state a reason, set a window. Self-service, from desktop or mobile.
Quorum of approvers, resolved from AD groups. Sensitive tiers require step-up MFA — self-approval is blocked.
Provisioned to the exact scope and nothing more, for the approved window. The clock starts.
Access auto-revokes, the AD membership is removed, and the whole trail is written to the audit log.
One control plane for who can reach what, for how long, and on whose approval — with the evidence to prove it.
No standing privilege. Rights are minted on approval and evaporate on expiry — the attack window closes with the grant.
SMS, TOTP and push. Routine access needs a factor; privileged tiers demand a fresh step-up at approval time.
Create-user, grant admin, disable, device-revoke — proposed by one, applied only after a different admin approves.
Requester, approver, operator, auditor, admin — resolved at login from the AD groups you already manage.
Every request, decision, grant and revocation — written once, never updated in place, and searchable, filterable and exportable when someone asks who approved what.
The firewall allow-set is reconciled to live grants every 60 seconds. Runs in log mode first — so you can prove it non-disruptive against real traffic — then flips to deny-by-default with one reversible command.
Sentinel is built to consolidate a scattered, cloud-VPS estate back onto the enterprise hardware you already own — internal-only by default, never exposed to the open internet.
The controls auditors ask about aren't bolted on — they're how Sentinel works. Every access decision leaves a record you can hand over.
| What auditors ask | Handing out keys | With Sentinel |
|---|---|---|
| Who can reach production? | Whoever kept a key | Only active, approved grants |
| Who approved this access? | A chat message, maybe | A named, distinct approver + quorum |
| When does it end? | It doesn't | Auto-expires; membership removed |
| Was MFA enforced? | Depends on the person | On every grant; step-up for privileged |
| Can privileged actions be unilateral? | Yes | No — four-eyes, self-approval blocked |
| Where's the record? | Scattered, editable | One append-only log, searchable |
No. Sentinel governs the estate you already run — it authenticates against your Active Directory and provisions peers on your existing WireGuard hub behind the FortiGate. It's a control plane over your stack, not a rip-and-replace.
Internal-only by default. Services bind to internal addresses behind your firewall; any public exposure is an explicit, reviewed exception. Sentinel is designed to bring access home onto hardware you own.
Requests route to approvers resolved from your AD groups. A quorum of distinct people must approve — self-approval is blocked — and the most sensitive tiers require a fresh step-up MFA challenge before access is granted.
One append-only audit log covering every request, decision, grant, expiry and revocation — searchable and filterable. Separation of duties, MFA enforcement, and least-privilege are properties of the system, not manual process.
Self-service. A branded Windows client and a paired mobile app take a user from sign-in through MFA to a live tunnel; access appears when approved and disappears when the window closes.
See how governed, just-in-time access looks on your own estate — request, approve, time-box, log.