Console tour

This page walks through the hosted console: the header, then every page in the sidebar, with its tabs, what you can do there and the role each action needs.

Roles in the tables:

• Everyone: any role.
• Writer: analyst or administrator.
• Admin: administrator only.

The role and permission tables say what each role can do across the console and the API. Members restricted to projects cannot use Post to Slack, organization-wide alert destinations or the Relay panel.

Header

Control	What it does
Scope selector	Narrows the page to projects, environments and platforms. Shown on Live posture, Findings, Assets, Platform & TCB, Trust Graph, Image Registry, Governance, Runtime Detections and Reports.
Search	A command palette that finds assets, findings, keys, artifacts, hosts, checks and pages. Open it with ⌘K, Ctrl K or /.
Freshness	"Data fresh · swept …", "Data fresh · last upload …" or "No reports yet". An N stale pill links to Connections, and Live posture, Attested TEEs, Platform & TCB and Runtime Detections show a stale-data banner.
Export findings	Downloads every current finding and the scan history for the whole organization as untrust-findings-YYYY-MM-DD.json. It ignores the page's filters and scope. Shown on Live posture, Findings and Reports & trends.
Scan now	1 · Run locally shows the scan commands for your registered connections, with a Passive only --read-only toggle. 2 · Upload report uploads a JSON report (Writer).
Notifications, Glossary, theme	The bell, the glossary of untrust terms, and light or dark mode.

To export only what is on screen, use Export CSV or Export JSON on the Findings page instead of the header export.

Saved views

The scope selector has Saved views · saved on this device. Choose Save to keep the current scope in this browser. Built-in views: Production criticals, Unverified TEEs, Production critical assets and Unverified TEE assets.

Saved views on the Findings page are different: they are stored in your organization, with Save view, Make default and Delete view.

Keyboard shortcuts

Keys	Action
?	Show shortcut help.
Esc	Close a drawer or dialog.
j, k	Next and previous row.
g then a letter	Go to a page: p Live posture, f Findings, g Trust Graph, d Trust decisions, a Assets, h Platform & TCB, b Source analysis, i IaC scan, e Attested TEEs, r Reports & trends, v Governance, c Connections, n Runtime Detections, s Settings.

Overview

Live posture

The current state of your organization: KPI tiles for Open findings, Critical, Attack paths and New since last report, and live signals for Detections firing, Release gates, Hardware verified and Unattested inputs. Demo (--demo) reports are left out of the score.

View as (Engineer, Security lead, Auditor) changes the layout only, never what you can do. Print report prints the page.

Action	Role
Verify now, Trust chain	Everyone
Assign to me, Mark fixed	Writer
Post to Slack	Writer with organization-wide access; see Alerts and webhooks

Findings

Tabs: Open, Unassessed, Issues, Accepted risk, Snoozed.

Filter by cloud and TEE, severity, scan type (All checks, Cloud config, Bootstrap, Host, TEE runtime), lifecycle stage and open age, and group findings. Sort by severity, check id or category. Export CSV and Export JSON export the rows on screen.

Action	Role
Open in Inventory, View in Attack paths	Everyone
Save view, Make default, Delete view	Everyone
Accept risk, Suppress (finding drawer)	Writer
Bulk: Accept risk on N, Snooze N, Assign, Apply status	Writer
Suppression rules (Accepted risk tab)	Admin

Issues, exceptions, snoozes and suppression rules are explained in Issues, attack paths and exceptions.

Trust Graph

Two modes: Trust boundary, and Attack paths. The platform (AWS Nitro, GCP Confidential Space, Azure Confidential VMs, GPU CC or Host attestation) comes from the scope selector. Demo reports are never drawn.

Trust decisions

The ledger of key releases untrust gated (Decided) or saw in cloud logs (Observed). Filters: All, Released against policy, Released, Denied, No attestation, Observed, Decided. Columns: Time, Key, Requester, Evidence, Decision, Source, Receipt. A receipt reads verified, not verifying, legacy, not checked or unsigned. Read-only; see Governance.

Inventory

Assets & environments

Tabs: Assets and Environments.

Assets has sub-tabs Resources, Network, Identity and Access, each with CSV and JSON export. Access lists Principal, Type, Resource, Permission, How it was granted, Last used and Verdict.

Environments has sub-tabs Cloud accounts and Hardware fleets.

Action	Role
Add target, Save target (scan targets, with a CLI or "CI (GitHub Actions)" command)	Writer
Issue grant, Verify access, Copy grant, Rotate ExternalId (cloud accounts)	Admin
New fleet, Generate enrollment token, Save policy, Revoke collector	Admin

Other roles see fleet policies read-only. See Connect a cloud account and Enroll a collector.

Platform & TCB

Tabs: Hardware & firmware and Host baseline & TCB.

• Hardware & firmware has sub-tabs Fleets and Firmware. Group by hosting, platform or status, and filter to All fleets, Managed by me or Needs attention.
• Host baseline & TCB has sub-tabs Boot chain, Host settings and TCB status. TCB status has its own tabs, TCB status and Trust roots.

Action	Role
Download report (host)	Everyone
Re-attest now (host)	Writer
Block key release, Stop, Lift (host)	Admin
Refetch now, Raise fleet minimum, Schedule update (TCB)	Admin
Propose pin, Approve, Reject (measurement pin requests)	Admin

Pin requests are explained in Compute expected measurements.

Build

Source analysis

Tabs: Scans, Rules, Custom rules. The Rules table shows On, Rule, What it catches, Class, Scope, Severity, Mode, Hits, Source and Policy.

Action	Role
Create draft and shadow custom rules	Writer
Set rule levels and the profile; edit and delete custom rules	Admin

See Issues, attack paths and exceptions and CI gates.

Infra

IaC scan

The same tabs and roles as Source analysis. The Scans tab adds a Prevents column, and a finding's drawer offers a Suggested fix.

Key binding

A read-only release matrix: for each key, what happens for each simulated caller (Expected image, Debug TEE, Unsigned image, Old firmware, No TEE, Other account, Leaks). A key's drawer has tabs Overview, Policy and Activity. CoCo KBS, Vault and Thales HSM are shown as not connected.

Supply

Image Registry

Tabs: Artifacts, Trust policy and Discovery. Discovery depends on your deployment; ask your untrust contact if it is not available.

Action	Role
Upload registry report	Writer
Propose policy revision, Apply revision	Admin

Reproducible builds

Workload coverage, an artifacts table (Commit, CI builder, Signer, Rebuilds the same, Measurement pinned) and "Builds not in the registry".

Attest

Attested TEEs

Verified hardware evidence. Filter by verdict, verifier, "Failing on" and fleet. Columns: Workload · host, Verdict, First failing check, Checks, Chain · nonce · debug, Platform, Verifier, Age. Sections: Platform identity, Hardware review, Enrolled collector keys, Composite binding and Relay.

Action	Role
Approve, Quarantine (hardware review and TPM attestation-key review)	Admin

A fleet whose policy requires identity approval holds new hardware as pending until an administrator approves it. Quarantine needs a reason of up to 500 characters. A quarantined host never counts as verified and never receives a key through a release decision.

Reported claims

Tabs: Measurements and Guest policy. Columns: Workload / host, Verdict, Register, Expected (pinned), Reported. The drawer links to "Enforce at key release →" and "Re-baseline → <fleet> pins".

Test

Active tests and Verifier probe are opt-in tests run against staging, marked "opt-in · run against staging" in the sidebar. Ask your untrust contact before you use them.

Runtime

Runtime Detections

Tabs: Live events, Rules, Custom rules, Suppressions.

Action	Role
Resolve, Reopen, Mark benign, Open incident	Writer
Create custom detection rules	Writer
Mute	Admin

See Runtime detections and Issues, attack paths and exceptions.

Governance

Policies

The policy-by-stage table and the release gates. Policies are organization-wide: the scope selector does not narrow them.

Action	Role
Preview adding to or removing from the gate, Apply	Admin

See Governance.

Compliance

The Frameworks tab: control-level frameworks with Download JSON and Print / PDF, and the framework cards. Everyone can read it. See Compliance frameworks.

Settings

Connections

Tabs: Collectors & data, Scan history and Integrations.

• Collectors & data lists each evidence source with Source, Type, Authenticates with, Feeds, Coverage, Last report and Status.
• Integrations has the CI card and the alert destinations (signed webhook, Slack and PagerDuty). Jira, ServiceNow and Splunk have no connector.
• Download findings JSON exports your findings.

Action	Role
Configure alert destinations and the signed webhook	Admin
Enable hosted rebuilds	Admin

Hosted monitoring

The Monitoring · every 2h strip on Collectors & data shows hosted monitoring. Every 2 hours, untrust recomputes your organization's posture from the evidence you have already uploaded and reports which failing checks are new and which are resolved since the previous run. The strip shows when the next run is due and when the last one finished.

Hosted monitoring is not a live cloud scan. It does not reach your cloud accounts, collectors or systems, and it does not make stale evidence fresh. Freshness still comes from your scans, CI uploads and collectors.

Reports & trends

A weekly risk-score chart, the reports table, retired reports, drift since each target's previous report, and Download SARIF.

Action	Role
Retire, Restore a report	Admin

Settings

Tabs: General, Members, Projects, API reference.

Where	What	Role
General › API keys	Organization API keys	Admin
General › Audit log	The audit log	Auditor or Admin
General	Confidential Space token audience: the audience your Confidential Space attestation tokens must be minted for	Admin to change
Members	Invite, change role, remove	Admin
Projects	Projects, grants, project keys, restricting members to projects	Admin; project admins manage their own project's keys
API reference	The OpenAPI 3.1 description, with the narrowest role for each operation	Everyone

See Organizations, projects and roles.

Help

Docs

The in-console reference, with tabs Guides, Checks and Rules. The guides cover connecting a cloud account, CI, collectors and offline verification.