Concepts

How power-manage works under the hood:

• Architecture — control + gateway + agent, and what each one owns.
• Event sourcing — every state change is an immutable event; reads come from projections.
• Reconciliation — desired state, drift detection, and idempotent actions.
• RBAC and scopes — dynamic roles, user groups, and :self / :assigned permission scopes.
• Dynamic device groups — the query language that drives assignment targeting.
• Maintenance windows — when actions are allowed to actually run.
• Compliance — detection-only SHELL actions that flag drift without remediating it.
• Device inventory — what the agent reports about each device, baseline + osquery layered.
• Log collection — on-demand journalctl queries dispatched from the UI.
• osquery — opt-in integration for richer inventory and ad-hoc SQL queries.
• Action architecture — why actions aren't 1:1 with shell programs, and how the SDK substrate makes them pluggable.
• SSO (OIDC) — identity providers, the login flow, identity linking, and auto-provisioning.
• SCIM provisioning — automated user and group sync from your IdP, token handling, deprovisioning.
• Search — the valkey-search index behind global search, and how results honour object visibility.