Documentation · Architecture
The Control Plane plans; the Agent executes constrained operations
Sysaro’s primary architecture boundary separates the operator UI from privileged execution on the Linux host.
Verified against public version: 0.20.02026-09-15Factual boundary · roadmap is not presented as shipped
The Control Plane stores models, policy and jobs. The privileged Go Agent accepts known job types, validates bounded payloads and executes a specific operation. There is no generic endpoint for arbitrary root commands.
Operation flow
1
Operator
Selects an action in the Control Plane
2
Control Plane
Checks RBAC and builds a typed job
3
Agent
Checks contract, ownership and bounded values
4
Result
Returns structured state; audit stores actor/action
Trust boundaries
| Area | Current boundary |
|---|---|
| Browser | UI and explicit forms; secrets can be sealed for a specific Agent |
| Control Plane | Authentication, RBAC, desired state, audit, queue, application model |
| Agent | Privileged host operations constrained by typed contracts |
| Host services | nginx/systemd/databases/OCI remain separate native components |
mTLS and identity
Agent routes use mTLS identity, while node ownership is checked before the Control Plane serves sensitive artifacts.
The model is built around a self-hosted Control Plane: vendor endpoints are used for distribution/update rather than normal panel operation.