Lighthouse Labs

declare → gate → record

You Hold the Keys. The AI Does the Chores.

A supervised bridge for local agents to navigate bastions and WinRM targets—without ever touching a vault.

View on GitHub

v0.2.0 · supervised use · Proprietary

  1. start

    local operator

    $ Get-Service MonitoringAgent
    typed here · nothing stored

  2. gate

    the gate

    BLOCKEDCONFIRMALLOWED

    this command: allowed · still recorded

  3. hop 1

    bastion1 :2222

    ssh · key + password

  4. hop 2

    JumpServer01

    winrm in tunnel

  5. target

    win-target02

    exit 0

audit · one fsynced line per action{"action":"COMMAND_EXECUTE","target":"win-target02","result":"SUCCESS"}

Illustration of a declared route from the example inventory. Only the SSH leg is a verified path. WinRM through a bastion is unit-tested, and Windows jump host to Windows target is not yet proven; see which paths are.

Why

Every hop costs a login. None of it is recorded.

This is the careful version.

Declared, never discovered.

Every route is written in the inventory. The tool does not scan for paths, and it does not cross from one environment into another.

Catalogued, not improvised.

Operations have names, are bound to the hosts they may run on, and can be narrowed again for a single session.

Typed, never stored.

A person types the password at every hop. It is held in memory for the session, wiped on disconnect and scrubbed from output.

Gates

Five gates, not one flag.

Every command is judged before it leaves your machine.

  1. RouteThe host must have a declared route. Nothing is discovered.
  2. Catalogue bindingThe operation must be bound to that host.
  3. Session allow-list--ops limits one session to named catalogue operations. Ad-hoc commands still meet the deny-list.
  4. Permission gateGated operations need a person. An agent's --confirm carries no weight; without AgentLighthouse its request is refused.
  5. Command deny-listCommand text is checked against two tiers, below.
BLOCKED

Blocked outright. No flag overrides it.

Format-Volumemkfsdd of=/dev/sdarm -rf /Disable-PSRemoting
CONFIRM

Runs only after a person approves the rendered command. An agent's --confirm does not count.

Restart-ComputerStop-Servicemsiexec /xchmodapt install
ALLOWED

Goes straight through, and is still recorded.

Get-Servicedf -ktailhostname

The command bench

Pick a command and watch it go through. An illustration of documented behaviour, not live traffic.

  1. commandpick one
  2. gate—
  3. hop 1bastion1
  4. hop 2JumpServer01
  5. targetwin-target02
  6. audit—

Nothing sent yet.

Audit line for the command
 

This is not a sandbox. It stops a plausible mistake from becoming an outage; sshd_config is still the real control.

Capabilities

What changes in a change window.

Zero-storage credentials

Prompted per hop, held in memory, wiped on disconnect. Keyboard-interactive and MFA prompts pass through to you.

In-process tunnels

The equivalent of ssh -L, opened inside the process, so there is no second terminal to manage.

WinRM, not RDP

Real output streams and real exit codes, including MSI 1603 and 3010.

The wrong-host guard

ac verify --expect-hostname checks that the machine you reached is the machine you meant.

Failure diagnosis

Nominated logs are collected, an exit-code hint is added, and --start-at resumes from the failed step.

An audit trail with identity

One fsynced JSON line per action, across 16 action types, each tied to an agent and session identity.

Session

The session window is a prompt.

It always names the machine your next command reaches.

Illustration of an access-control session
$ uv run ac connect win-target02
  hop 1  bastion1       operator@bastion1.example.net:2222   authenticated
  hop 2  JumpServer01   winrm, in-process tunnel             authenticated
deploy@win-target02 [win-target02] > hostname
WIN-TARGET02
exit 0 via winrm
deploy@win-target02 [win-target02] > Format-Volume -DriveLetter D
COMMAND_BLOCKED  deny-list tier: BLOCKED · recorded, not sent

Illustration with placeholder hosts; the output layout is simplified.

If the last leg fails but a bastion authenticated, the session is held at that hop instead of being thrown away. The prompt is marked FALLBACK, and :retry tries the final leg again at no credential cost.

Evidence

Proven where it says so.

And nowhere else.

  • SSH through bastionsUnix targets, verified end to end on AIX.Verified
  • Direct WinRMVerified against Windows Server 2022.Verified
  • WinRM through an SSH bastionImplemented and unit-tested; prove it with ac probe --deep and a read-only operation first.Unit-tested
  • Nested Windows to WindowsNot yet proven on real hardware.Not yet proven

Ready for supervised use on the SSH and direct-WinRM paths; the readiness assessment predates version 0.2.0. A live run found three defects the offline tests missed, and they were fixed.

optional · AgentLighthouse

Add a gate a flag cannot satisfy.

Optional: run access-control behind AgentLighthouse. A plain install is standalone and changes nothing. Opt in with access-control[lighthouse].

  • out-of-band approval
  • identity-bound policy
  • signed, hash-chained receipts from AgentLighthouse
See AgentLighthouse →

Limits

What it is not.

None of this is hidden in the docs.

  • It cannot run unattended.A person opens every session and types every credential.
  • Operations are not idempotent.It is procedural, like a runbook. After a failure, fix the cause and resume with --start-at.
  • It is not a sandbox.The servers' own access controls remain the real boundary.
  • The route graph and deny-list are advisory.They catch plausible mistakes; they do not stop a determined one.
  • The audit trail is not tamper-evident.It is written by the audited process. Treat it as a record, not as proof.
  • A handful of hosts, not a fleet.One person-opened session per host; a campaign drives up to 8 at once by default.

Try it

First session, step by step.

Nothing is installed on the servers.

First-session commands
$ git clone https://github.com/neural-nomad1709/access_control
$ git clone https://github.com/neural-nomad1709/agentlighthouse AgentLighthouse   # sibling checkout, required by uv sources
$ cd access_control
$ uv sync
$ uv run ac doctor
$ uv run ac routes
$ uv run ac probe target1 --deep
$ uv run ac connect target1 --ops install-package       # passwords are prompted here, per hop
$ uv run ac verify target1 --expect-hostname TARGET1
$ uv run ac preview target1 install-package -p package=agent.msi
Source (proprietary) docs/INSTALLATION.md docs/guides/runbook.md

Proprietary. The repository has no licence file; ask before use. Hostnames above are placeholders. AC_ALLOW_ENV_CREDENTIALS is a testing-only switch; leave it unset.

Every hop declared. Every credential typed. Every action on the record.

← Back to Lighthouse Labs