Administration
One console. Total command.
The Aegis Control Plane admin console governs every user, document, policy, and byte. It sits behind a mandatory-2FA privileged gate, with forensic auditing of every action.
Console capabilities
Everything an administrator needs
Identity lifecycle
Create, suspend, reset, and group users from one console. Role changes take effect on the next decision, instantly and audibly.
Aegis Shield policies
Deterministic Allow/Deny rules with per-user and per-group exceptions. Every override is explicit, versioned, and reproducible.
Mandatory 2FA gate
The privileged console itself sits behind organization-wide two-factor authentication. No shared passwords, no standing access.
Forensic auditing
47 audited event types with IP, geolocation, and session context, exportable to CSV for compliance and incident response.
Guarded storage ops
Storage mounts and scopes are managed with confirmation flows and full audit trails. Destructive resets require typing RESET to confirm — physical files are never touched.
License control plane
Bind a license to the instance hardware ID, activate or transfer it, and deactivate before migrating hardware. Air-gapped instances run from a static offline lease with sync hidden.
Identity & access
Everything about a user, under your control
From provisioning to deletion, the administrator owns the complete identity lifecycle — and every change takes effect immediately.
Full user lifecycle
Create, update, and delete users with username, email, and full legal name. Deleting a user preserves their complete audit history for forensic continuity.
Instant account suspension
Deactivate any account with one toggle. The user's session is terminated on their very next request — no propagation delay, no grace window.
Credential control
Set initial passwords and reset credentials at any time, with server-side hashing and a client-enforced strength policy.
SuperAdmin designation
Grant or revoke the global admin flag. SuperAdmins bypass Shield evaluation entirely — and are hard-required to enroll in 2FA before touching any admin endpoint.
Group membership
Organize users into groups that inherit attached Shield policies. Membership changes purge the policy cache immediately — effective on the next request.
Per-user inline exceptions
Attach a personal Shield policy directly to any user — one-off grants or denials that don't belong in a group. The user modal also surfaces group membership and a live effective-access view.
Aegis Shield · ASP
Decide exactly who can do what, where
Shield policies are IAM-style JSON documents evaluated deterministically: default-deny, explicit Allow grants, and explicit Deny always wins. Attach them to groups — or to a single user as an inline exception.
# example — read-only auditors, MFA required
{ "Version": "2026-04-25", "Statement": [{ "Effect": "Allow", "Action": ["vfs:ListDirectory", "vfs:Read"], "Resource": ["urn:aegis:vfs:path/Contracts/*"], "Condition": { "Bool": { "aegis:MultiFactorAuthPresent": "true" } } }, { "Effect": "Deny", "Action": ["vfs:DownloadFile", "vfs:Delete"], "Resource": ["urn:aegis:vfs:*"] }] }
VFS actions
vfs:ListDirectoryvfs:Readvfs:DownloadFilevfs:UploadFilevfs:CreateFoldervfs:DeleteDelegable admin actions
Grant operational capabilities to non-admins without handing over the keys.
admin:StorageManageadmin:StorageBrowsePhysicaladmin:ShieldManageadmin:ShieldViewadmin:AuditViewScoped resources
URN-based targets with wildcard support — from urn:aegis:* down to a single mount, folder subtree, or document. A visual rule builder with a folder picker composes the policy for you.
Security posture
Set the bar. The platform enforces it.
Organization-wide security controls are configured once in Global Settings and enforced by the server on every request.
Organization-wide 2FA enforcement
One toggle forces every user to bind a TOTP authenticator. Non-compliant users are intercepted by a captive portal immediately after login — no exceptions.
Privileged access requires 2FA. Always.
The root administrator is forced through TOTP enrollment during first-boot provisioning, and every admin endpoint rejects admins without active 2FA.
Trusted devices, on your terms
Define the maximum trust window (1–365 days). Users may skip 2FA on trusted devices — admins never can. All trusted devices are revoked automatically on password change.
Server-side sessions
Sessions live in PostgreSQL, expire after 8 hours of inactivity, and cycle their ID on every login. Secure, HttpOnly, SameSite=Strict cookies in production.
Dynamic watermark engine
Compose the forensic watermark template with live tokens — company name, username, full name, email, IP address, timestamp — and tune opacity from 5% to 50% (12% by default).
Office documents, view-only
The server hard-sets the embedded Office configuration — read-only by default with download, print, copy, and review disabled. Where a Shield policy grants edit, changes save back through the server.
Network context rules
CIDR lists decide which requests bypass Turnstile or 2FA and which groups or Shield policies they inherit. The server's own IP is auto-detected, and a built-in tester shows exactly which rules a request matches.
Branding & organization
Set the organization name and upload the console logo — PNG, JPEG, WebP, or SVG up to 2 MB — applied across the interface and the watermark template.
Recycle bin retention
Decide how long deleted files stay recoverable — from 1 to 3,650 days, 30 by default — before the server purges them on schedule.
Storage & search operations
Your storage, precisely indexed
Connect physical volumes, decide exactly what enters the virtual file system, and control how content is extracted for full-text discovery.
Storage mounts
Mount physical host directories as labeled VFS volumes, with one-click auto-discovery of mountable paths and path-traversal jailing on physical browsing.
Indexing rules
Per-mount include/exclude prefix rules chosen from a live file-tree browser. Include rules act as a strict whitelist over what enters the VFS.
Full-text search scopes
Define exactly which VFS subtrees get content-indexed, then trigger extraction with a configurable worker pool (1–16 parallel workers). Engine health shows indexed documents and disk usage, with a full reindex on demand.
Failure taxonomy
Every skipped document is audited with its cause: ENCRYPTED/PROTECTED, CORRUPTED, TIMEOUT, UNSUPPORTED, or NO_TEXT — nothing fails silently.
Guarded destructive resets
Purge the search cluster or reset the entire VFS cache — both require typing RESET to confirm. Physical files are never touched.
Forensic auditing
Every action leaves a fingerprint
The activity log is a forensic-grade record of everything that happens in the system — written asynchronously, indexed for fast retrieval, and exportable for compliance.
Day-to-day operations
Run the platform from one console
Monitoring and background jobs — the operational surface an administrator needs every day.
Command dashboard
Registered users, active groups, indexed PDFs and pages, file-type distribution, and the largest folders — refreshed every 30 seconds.
Background task control
Live progress on every sync, extraction, and export job, with a single control to stop all active work from the admin sidebar.
Take the wheel on a live instance
We will hand you the console in your own environment and walk through policy, identity, and audit workflows end to end.