Firms, Customers, Endpoints

The portal counts in four levels and keeps them apart on purpose. Your firm is the company you sign in as. A customer is a company you manage. An account is a Whisper principal and its key, held under a customer. An endpoint is one machine, agent or controller, and the address it answers on.

Your firm

The firm is your own company. It is kept apart from a customer, which is a company you manage, so nothing a colleague does inside your firm is ever confused with something done inside an estate you are managing. Colleagues are members of the firm and carry a role there; your team and roles covers what each role reaches.

A customer

A customer is one company. The roster under it is flat: no sites, and no sub-organisations beneath a company.

When you add one, you also record its adoption shape: one account for the whole company, or an account for each person who works there. The shape is a label you read on the row, not a branch in the product. An email domain can be recorded beside it.

An account

An account is a Whisper principal and its key. Endpoints live under an account, and one customer can hold a single account or many.

The account is the level the control plane works at. That is why a firm reaches a customer by holding that customer's key: the portal signs in as your firm, and then acts inside the estate as the account.

An endpoint and its identity

An endpoint is one machine, agent or controller, and the routable IPv6 /128 it answers on. The address is the identity. It is allocated out of Whisper-held address space and published in public DNS and in the public registry, so anyone can check it with no account here and nothing installed on the machine. Agent identity describes the proof chain behind it.

An endpoint that cannot carry a sensor is still an endpoint. It holds an address and resolves names through the customer's policy, which is enough to be seen, scored and contained.

The estate, and the grant over it

An estate is everything belonging to one customer on the plane: its accounts, its endpoints, its policy and its record.

A grant is the authority a customer gives your firm to act inside that estate. Without a grant the portal reads nothing from it and says so, rather than rendering a zero. A zero reads as a quiet customer, and an unread estate is not a quiet one.

One customer, end to end

A company is added with one account for the whole company. Its laptops bind to that account, each taking its own address. A controller that cannot run a sensor is added the same way and resolves names through the same policy. All of it is one estate, reached with one key, and it appears in the book as a single row with everything it is carrying beside it.