[{"data":1,"prerenderedAt":2545},["ShallowReactive",2],{"page-\u002Fbyodt-cloud\u002Fcloud":3,"navigation":2222},{"id":4,"title":5,"body":6,"description":2205,"extension":2206,"meta":2207,"navigation":2217,"path":2218,"seo":2219,"stem":2220,"__hash__":2221},"docs\u002F02.byodt-cloud\u002F04.cloud.md","Connecting the BYODt Deployment to the Cloud",{"type":7,"value":8,"toc":2167},"minimark",[9,14,18,21,42,45,87,90,95,174,179,189,205,217,221,232,234,238,285,294,306,334,338,376,379,385,388,397,408,412,415,429,432,443,450,454,457,464,482,485,531,538,543,545,549,560,563,663,666,671,681,684,733,735,739,744,747,751,802,809,813,973,976,979,991,996,1000,1010,1018,1021,1032,1035,1039,1049,1056,1062,1065,1150,1159,1162,1165,1175,1180,1229,1235,1241,1251,1254,1257,1260,1284,1287,1309,1315,1320,1322,1326,1329,1404,1410,1425,1427,1430,1436,1444,1450,1453,1509,1513,1605,1619,1629,1641,1647,1651,1654,1661,1666,1669,1677,1691,1695,1698,1703,1706,1709,1712,1717,1727,1744,1751,1783,1800,1804,1853,1857,1863,1883,1889,1892,1895,1901,1912,1915,1918,1946,1953,1955,1958,1965,1973,2026,2032,2042,2070,2072,2076,2079,2126,2128,2132,2143,2147,2163],[10,11,13],"h1",{"id":12},"connecting-the-deployment-to-the-cloud","Connecting the Deployment to the Cloud",[15,16,17],"p",{},"A BYODt deployment runs standalone by default and calls out to nothing. Connecting it to the cloud is opt-in, done entirely from the operator console, and reversible.",[15,19,20],{},"Connecting adds two things:",[22,23,24,32],"ul",{},[25,26,27,31],"li",{},[28,29,30],"strong",{},"Sign-in for your team."," The platform and the console both authenticate against your account's identity provider instead of running unauthenticated.",[25,33,34,37,38,41],{},[28,35,36],{},"Content packages."," A ",[28,39,40],{},"Content"," tab appears in the console, listing curated content packages you can mount into the deployment.",[15,43,44],{},"What does not change: your data. The graph stays in your database, on your machine, in both modes.",[15,46,47,48,53,54,53,58,62,63,67,68,53,71,53,74,77,78,81,82,86],{},"Connecting is four tasks, done in this order: ",[49,50,52],"a",{"href":51},"#register-the-two-callbacks","register the two callbacks",", ",[49,55,57],{"href":56},"#paste-the-recipe-and-apply","paste the recipe and apply",[49,59,61],{"href":60},"#recreate-the-stack","recreate the stack",", and ",[49,64,66],{"href":65},"#sign-in","sign in",". These tasks carry no numbers of their own. The numbered sections the guide names — ",[28,69,70],{},"1 · Access and callbacks",[28,72,73],{},"2 · Configuration",[28,75,76],{},"3 · Who may sign in"," — are sections of the console's ",[28,79,80],{},"Cloud"," tab, and section 3 is not the third task here: it is a later decision, covered under ",[49,83,85],{"href":84},"#changing-who-may-sign-in","Changing who may sign in",".",[88,89],"hr",{},[91,92,94],"h2",{"id":93},"before-you-start","Before you start",[96,97,103],"div",{"className":98,"tabIndex":100,"role":101,"ariaLabel":102},[99],"table-frame",0,"region","Table: Before you start",[104,105,106,119],"table",{},[107,108,109],"thead",{},[110,111,112,116],"tr",{},[113,114,115],"th",{},"Prerequisite",[113,117,118],{},"Why",[120,121,122,135,153,161],"tbody",{},[110,123,124,128],{},[125,126,127],"td",{},"A healthy deployment",[125,129,130,131,134],{},"Check the console shows a ",[28,132,133],{},"Healthy"," verdict first. Connecting a deployment that is already failing only makes the diagnosis harder.",[110,136,137,140],{},[125,138,139],{},"An account that issues a deployment recipe",[125,141,142,143,146,147,86],{},"The recipe is the block of settings you paste into the console. Get it from the ",[28,144,145],{},"BYODt Portal",", which the console links to. Creating the account and subscribing are covered in ",[49,148,152],{"href":149,"rel":150},"https:\u002F\u002Fdocs.dether.net\u002Fbyodt-subscription\u002F",[151],"nofollow","BYODt subscription",[110,154,155,158],{},[125,156,157],{},"Access to your account's callback settings",[125,159,160],{},"You must register two callback URLs before sign-in will work.",[110,162,163,166],{},[125,164,165],{},"The console reached at a secure address",[125,167,168,169,173],{},"Either a ",[170,171,172],"code",{},"localhost"," address, or HTTPS. See below.",[175,176,178],"h3",{"id":177},"the-secure-address-requirement","The secure-address requirement",[15,180,181,182,185,186,188],{},"Browsers only expose the cryptography that sign-in needs on a ",[28,183,184],{},"secure context",": an HTTPS page, or a ",[170,187,172],{}," address. This has two consequences:",[22,190,191,198],{},[25,192,193,194,197],{},"If you reach the console at ",[170,195,196],{},"http:\u002F\u002F127.0.0.1:3000\u002Fconsole\u002F",", everything works as-is.",[25,199,200,201,204],{},"If you reach it at any other address over plain HTTP, sign-in cannot run, and the console will tell you so and point you at ",[170,202,203],{},"byodt tls generate",". The console will also refuse the configuration itself, because it will not write a plaintext, non-local callback into the platform's settings.",[15,206,207,208,212,213,216],{},"So: for anything other than a loopback deployment, ",[49,209,211],{"href":210},"\u002Fbyodt-cloud\u002Foperations#tls-at-the-front-door","install a certificate"," ",[28,214,215],{},"before"," you start here.",[175,218,220],{"id":219},"use-the-address-you-will-keep-using","Use the address you will keep using",[15,222,223,224,227,228,231],{},"The two callbacks the console shows you are derived from the address in your browser's bar. Register them, and then keep reaching the deployment at that same address. If you register callbacks while browsing ",[170,225,226],{},"http:\u002F\u002F127.0.0.1:3000"," and later switch to ",[170,229,230],{},"https:\u002F\u002Fdeployment.example:3000",", sign-in will be rejected until you register the new pair.",[88,233],{},[91,235,237],{"id":236},"register-the-two-callbacks","Register the two callbacks",[239,240,241,247,267,278],"ol",{},[25,242,243,244,246],{},"Open the console and select the ",[28,245,80],{}," tab.",[25,248,249,250,252,253,263,266],{},"Find section ",[28,251,70],{},". It shows a read-only box with two URLs, one per line:",[254,255,260],"pre",{"className":256,"code":258,"language":259},[257],"language-text","http:\u002F\u002F127.0.0.1:3000\u002Fauth\u002Fcallback\nhttp:\u002F\u002F127.0.0.1:3000\u002Fconsole\u002Fauth\u002Fcallback\n","text",[170,261,258],{"__ignoreMap":262},"",[264,265],"br",{},"The first is the platform's sign-in. The second is the console's own. Both are on the same address, because the console is served through the same front door as the platform.",[25,268,269,270,273,274,277],{},"Click ",[28,271,272],{},"Copy",". The console confirms with ",[170,275,276],{},"Copied."," If your browser blocks clipboard access, it selects the text instead and tells you to copy it by hand.",[25,279,280,281,284],{},"Paste both lines into the ",[28,282,283],{},"Callback URLs"," field of your account in the portal, one per line, and save.",[286,287,288],"blockquote",{},[15,289,290,293],{},[28,291,292],{},"They must match exactly."," A callback that is not registered is rejected by the identity provider before it ever reaches your deployment — which means nothing in your own logs explains it. The console names the exact value to register if this happens.",[286,295,296],{},[15,297,298,299,301,302,305],{},"The loopback addresses for the default ports are registered for you, both ",[170,300,172],{}," and ",[170,303,304],{},"127.0.0.1",".\nPaste the two lines anyway — saving a URL that is already registered changes nothing, and the cost of\nskipping it is a rejection you cannot diagnose from your own logs.",[286,307,308],{},[15,309,310,313,314,301,316,318,319,322,323,325,326,330,331,333],{},[28,311,312],{},"The numbers on the Cloud tab match the portal's Deployment page."," Sections ",[28,315,70],{},[28,317,73],{}," carry the same numbers on both, so with the two open side by side you read one sequence. Each has a third step, and the two are deliberately different decisions: on the portal it is ",[28,320,321],{},"3 · Team"," — who is on the team: members, roles and invitations, shown to the team's owner only — and on the console it is ",[28,324,76],{},", which of those members ",[327,328,329],"em",{},"this"," deployment admits. The console's step 3 appears only once the deployment is connected, because it lists the team the connection names; it is covered under ",[49,332,85],{"href":84},". Selecting is not inviting: adding someone to the team stays in the portal.",[91,335,337],{"id":336},"paste-the-recipe-and-apply","Paste the recipe and apply",[239,339,340,346,353,371],{},[25,341,269,342,345],{},[28,343,344],{},"Get your deployment recipe ↗"," at the top of the Cloud tab. It opens the portal page that issues the recipe for this deployment.",[25,347,348,349,352],{},"Copy the whole recipe. It is a block of plain ",[170,350,351],{},"NAME=value"," lines.",[25,354,355,356,358,359,364,366,367,370],{},"Back in the console, in section ",[28,357,73],{},", paste it into the text area. Above the box the console says:",[286,360,361],{},[15,362,363],{},"Every member of your team will be able to sign in. If this deployment will hold a client's data, narrow who can sign in before you load it.",[264,365],{},"The recipe lists your whole team, because the portal does not know who works on which client. If this deployment is for one client, the order of work is: connect, restart, sign in, ",[49,368,369],{"href":84},"choose who may sign in",", restart again, and only then load the client's data.",[25,372,269,373,86],{},[28,374,375],{},"Apply cloud configuration",[15,377,378],{},"On success the console reports:",[254,380,383],{"className":381,"code":382,"language":259},[257],"cloud configuration written; apply it by recreating the stack: byodt restart\n",[170,384,382],{"__ignoreMap":262},[15,386,387],{},"It may add a sentence saying it kept this deployment's own exposure declaration rather than taking it from the recipe. That is intentional: the console never lets a pasted recipe change how exposed your deployment declares itself to be.",[15,389,390,393,394,396],{},[28,391,392],{},"If the recipe is rejected",", the message says exactly why — a line that is not ",[170,395,351],{},", a variable named twice, required variables missing, or variables the console will not write. In every case the fix is the same: copy the recipe again, whole and unedited, and paste it without modification.",[286,398,399],{},[15,400,401,404,405,407],{},[28,402,403],{},"Other console tabs are signed out at this point."," The deployment's posture just changed, so every console session minted under the old one is dropped. The tab you applied from stays signed in for a short grace period — long enough to read the message above and ",[49,406,61],{"href":60}," — and then it, too, asks you to sign in. Nothing is wrong either way: you do not need to be signed in to the console to recreate the stack.",[91,409,411],{"id":410},"recreate-the-stack","Recreate the stack",[15,413,414],{},"From your terminal, in the bundle directory:",[254,416,420],{"className":417,"code":418,"language":419,"meta":262,"style":262},"language-sh shiki shiki-themes github-light github-dark-dimmed",".\u002Fbyodt restart\n","sh",[170,421,422],{"__ignoreMap":262},[423,424,427],"span",{"class":425,"line":426},"line",1,[423,428,418],{},[15,430,431],{},"This is what makes the change live. Until you run it, the console shows a standing banner:",[286,433,434],{},[15,435,436,439,440,86],{},[28,437,438],{},"Cloud configuration not yet applied"," — A cloud configuration is written but the platform is not running it — recreate the stack to apply it: ",[170,441,442],{},"byodt restart",[15,444,445,446,449],{},"Recreating takes the usual few moments. ",[170,447,448],{},".\u002Fbyodt status"," shows the services healthy again when it is done.",[91,451,453],{"id":452},"sign-in","Sign in",[15,455,456],{},"Reload the console. It now presents a sign-in card:",[286,458,459],{},[15,460,461,463],{},[28,462,453],{}," — This deployment is connected to the cloud. Sign in with your account to manage it.",[239,465,466,476,479],{},[25,467,269,468,471,472,475],{},[28,469,470],{},"Sign in with SSO",". The button changes to ",[170,473,474],{},"Redirecting…"," and the browser leaves for your identity provider.",[25,477,478],{},"Sign in there.",[25,480,481],{},"You return to the console, signed in.",[15,483,484],{},"You will know it worked:",[96,486,489],{"className":487,"tabIndex":100,"role":101,"ariaLabel":488},[99],"Table: Sign in",[104,490,491,501],{},[107,492,493],{},[110,494,495,498],{},[113,496,497],{},"Where",[113,499,500],{},"What you see",[120,502,503,512,520],{},[110,504,505,508],{},[125,506,507],{},"Top-right badge",[125,509,510],{},[28,511,80],{},[110,513,514,517],{},[125,515,516],{},"Header",[125,518,519],{},"Your name or email address",[110,521,522,525],{},[125,523,524],{},"Tabs",[125,526,527,528,530],{},"A third tab, ",[28,529,40],{},", has appeared",[15,532,533,534,537],{},"The platform itself now requires sign-in too. Open it from ",[28,535,536],{},"Open platform →"," in the console header.",[286,539,540],{},[15,541,542],{},"Console sessions last about an hour, after which the console asks you to sign in again. That is the revocation window, not a fault.",[88,544],{},[91,546,548],{"id":547},"who-can-change-a-connected-deployment","Who can change a connected deployment",[15,550,551,552,555,556,559],{},"Signing in gets you the console. ",[28,553,554],{},"Changing"," the deployment needs one thing more: you must be an administrator of the team the deployment belongs to. Reading is not restricted — anyone who can sign in sees the deployment's state, the catalog, what is mounted, and what is installed — with one exception: ",[28,557,558],{},"who may sign in",". The card that lists your team's members and who among them may sign in is shown only to an administrator, because of what it reveals rather than what it changes.",[15,561,562],{},"These are the controls that need the role:",[96,564,567],{"className":565,"tabIndex":100,"role":101,"ariaLabel":566},[99],"Table: Who can change a connected deployment",[104,568,569,578],{},[107,570,571],{},[110,572,573,576],{},[113,574,575],{},"Control",[113,577,497],{},[120,579,580,602,615,625,649],{},[110,581,582,599],{},[125,583,584,53,587,53,590,53,593,53,596],{},[28,585,586],{},"Mount",[28,588,589],{},"Mount all",[28,591,592],{},"Update",[28,594,595],{},"Unmount",[28,597,598],{},"Unmount all",[125,600,601],{},"Content tab",[110,603,604,613],{},[125,605,606,301,609,612],{},[28,607,608],{},"Install",[28,610,611],{},"Remove",", for entitled artifacts",[125,614,601],{},[110,616,617,623],{},[125,618,619,622],{},[28,620,621],{},"Update to the … version",", on the knowledge-graph entry",[125,624,601],{},[110,626,627,644],{},[125,628,629,630,633,634,53,637,640,641],{},"The ",[28,631,632],{},"Who may sign in"," card — seeing the team and the ticks, ",[28,635,636],{},"Apply",[28,638,639],{},"Remove people who have left",", and the paste box's ",[28,642,643],{},"Apply access list",[125,645,646,647],{},"Cloud tab, section ",[28,648,76],{},[110,650,651,656],{},[125,652,653],{},[28,654,655],{},"Disconnect from cloud",[125,657,658,659,662],{},"Cloud tab, the ",[28,660,661],{},"Disconnect"," section at the foot",[15,664,665],{},"The console does not hide them from you. It disables them and says why beside them:",[286,667,668],{},[15,669,670],{},"Only an administrator of this deployment’s team can change what it provides or see who may sign in to it. An owner or administrator of that team can grant you the administrator role in the portal.",[15,672,673,674,677,678,680],{},"The Content tab says the same as a banner across the top: ",[28,675,676],{},"You can see this deployment, but not change it",". The ",[28,679,632],{}," card shows the sentence and nothing else — no list, no ticks, nothing about who has left.",[15,682,683],{},"Four things are worth knowing about how the check runs:",[22,685,686,696,709,719],{},[25,687,688,691,692,695],{},[28,689,690],{},"It is asked of the cloud every time, and never remembered."," A role granted or withdrawn in the portal takes effect on your next attempt. You do not have to sign in again for it — though the Content tab only learns which controls to offer when it reads the catalog, so click ",[28,693,694],{},"Refresh"," there to see the buttons change.",[25,697,698,701,702,704,705,708],{},[28,699,700],{},"It uses the cloud credential this browser tab holds",", which lives only in memory. Reloading the page clears it while leaving you signed in to the console, so the console may send you to sign in again when you use one of these controls. That is the ordinary state of a reloaded tab, not a fault. The ",[28,703,632],{}," card does not send you anywhere on its own: in a reloaded tab it offers a ",[28,706,707],{},"Sign in to the cloud"," button and waits.",[25,710,711,714,715,86],{},[28,712,713],{},"A refusal always means nothing was changed."," The four ways it can refuse, and what each one calls for, are in ",[49,716,718],{"href":717},"\u002Fbyodt-cloud\u002Ftroubleshooting#cloud-connect-and-sign-in","Troubleshooting → Cloud connect and sign-in",[25,720,721,724,725,727,728,732],{},[28,722,723],{},"A deployment connected with a recipe that names no team is not checked at all",", and every control behaves as it did before the check existed — except the ",[28,726,632],{}," card, which cannot list a team the deployment does not name and offers the paste box instead (",[49,729,731],{"href":730},"#when-the-deployment-names-no-team","below","). The check turns itself on for a deployment when it is next connected with a recipe that names one.",[88,734],{},[91,736,738],{"id":737},"mounting-content-packages","Mounting content packages",[15,740,629,741,743],{},[28,742,40],{}," tab appears only once the platform is actually running in cloud mode. It lists the packages available to you, with your subscribed ones ready to mount. Your subscription is read again each time the console loads, so what you see is what you are subscribed to now — not what you were subscribed to when you connected.",[15,745,746],{},"Mounting is not a download. It writes a small marker into the deployment's modules directory naming the module and the exact content version to serve; the content itself is delivered per request. This is why mounting is instant and why it needs a platform recreate to take effect.",[175,748,750],{"id":749},"mount-a-module","Mount a module",[239,752,753,758,765,773,787],{},[25,754,755,756,246],{},"Select the ",[28,757,40],{},[25,759,760,761,764],{},"Click a package name to expand it. Packages are collapsed by default, and each row shows how many of its modules are mounted (",[170,762,763],{},"2\u002F5 mounted",").",[25,766,269,767,769,770,772],{},[28,768,586],{}," on a module — or ",[28,771,589],{}," on the package header to take every module in it.",[25,774,775,776],{},"The console confirms, and a banner appears at the top of the tab:",[286,777,778],{},[15,779,780,783,784],{},[28,781,782],{},"Restart required to apply your changes"," — Your changes on this tab take effect when you recreate the platform: ",[170,785,786],{},"byodt restart platform",[25,788,789,790,799,801],{},"Run it:",[254,791,793],{"className":417,"code":792,"language":419,"meta":262,"style":262},".\u002Fbyodt restart platform\n",[170,794,795],{"__ignoreMap":262},[423,796,797],{"class":425,"line":426},[423,798,792],{},[264,800],{},"The platform then embeds the new classes (about 0.2 s each); they match by name until it finishes.",[15,803,804,805,86],{},"Only the platform is recreated. The database and the console keep running. To confirm the module works end to end, run the ",[49,806,808],{"href":807},"#check-the-connection","three checks",[175,810,812],{"id":811},"package-and-module-states","Package and module states",[96,814,817],{"className":815,"tabIndex":100,"role":101,"ariaLabel":816},[99],"Table: Package and module states",[104,818,819,828],{},[107,820,821],{},[110,822,823,825],{},[113,824,500],{},[113,826,827],{},"Meaning",[120,829,830,842,852,865,875,892,906,925,938,948],{},[110,831,832,839],{},[125,833,834,836,837],{},[28,835,586],{}," \u002F ",[28,838,589],{},[125,840,841],{},"Not mounted yet.",[110,843,844,849],{},[125,845,846],{},[170,847,848],{},"up to date",[125,850,851],{},"Mounted at the newest published content version.",[110,853,854,859],{},[125,855,856],{},[170,857,858],{},"newer available (X.Y.Z)",[125,860,861,862,864],{},"A newer content version exists. An ",[28,863,592],{}," button appears next to it.",[110,866,867,872],{},[125,868,869],{},[170,870,871],{},"update unknown",[125,873,874],{},"The catalog could not be consulted, so currency could not be judged. The mount itself is fine.",[110,876,877,886],{},[125,878,879,882,883],{},[28,880,881],{},"Not subscribed"," + ",[28,884,885],{},"Subscribe ↗",[125,887,888,889,891],{},"Your account is not subscribed to this package. Mounting is disabled, because the platform would refuse to serve the content. This is your subscription as of this moment: subscribe, then click ",[28,890,694],{}," — you do not have to disconnect and reconnect to pick it up.",[110,893,894,900],{},[125,895,896,897],{},"A muted line above the list: ",[327,898,899],{},"Your subscription has not been checked. Signing in again gives this tab the cloud credential it needs…",[125,901,902,903,905],{},"Reloading the page clears that credential, so this is the normal state of a fresh tab. Nothing is restricted. Click ",[28,904,453],{}," beside the line; the check runs again when you come back.",[110,907,908,914],{},[125,909,910,911],{},"A muted line above the list, beginning ",[327,912,913],{},"Nothing is restricted, but subscriptions cannot be checked on this deployment…",[125,915,916,917,919,920,924],{},"This deployment's configuration does not carry the permission the check needs, so signing in again and pressing ",[28,918,694],{}," will not change it. Get a fresh recipe from the portal, then ",[49,921,923],{"href":922},"#disconnecting","disconnect",", apply it, and connect again — read what disconnecting costs first.",[110,926,927,932],{},[125,928,896,929],{},[327,930,931],{},"Your subscription could not be checked just now.",[125,933,934,935,937],{},"The check did not go through this time. Nothing is restricted; click ",[28,936,694],{}," to try again.",[110,939,940,945],{},[125,941,942],{},[28,943,944],{},"Mounted — not in catalog",[125,946,947],{},"A module you mounted that the catalog no longer lists. Kept visible so you can still unmount it.",[110,949,950,955],{},[125,951,952,953],{},"A banner: ",[28,954,676],{},[125,956,957,958,53,960,53,962,53,964,966,967,969,970,86],{},"You are signed in, but you do not administer the team this deployment belongs to, so ",[28,959,586],{},[28,961,595],{},[28,963,608],{},[28,965,611],{}," and the knowledge graph's ",[28,968,592],{}," button are disabled. Nothing you can read is affected. See ",[49,971,548],{"href":972},"#who-can-change-a-connected-deployment",[175,974,694],{"id":975},"refresh",[15,977,978],{},"The console reads the catalog, your subscription, and what is mounted when it loads. It does not update on its own after that — switching to another tab and back does not re-read anything.",[15,980,269,981,983,984,986,987,990],{},[28,982,694],{},", at the top of the tab, to read all three again. This is how a new subscription reaches the console: subscribe in the portal, come back, click ",[28,985,694],{},", and the package is mountable straight away — you do not have to disconnect and reconnect for it. See ",[49,988,989],{"href":922},"Disconnecting"," for what that involves.",[15,992,993,995],{},[28,994,694],{}," is unavailable while a mount or unmount is running. Let it finish, then click it.",[175,997,999],{"id":998},"keep-mounts-current","Keep mounts current",[15,1001,1002,1003,1006,1007,1009],{},"A module marked ",[170,1004,1005],{},"newer available"," keeps serving the version you pinned until you act. Click ",[28,1008,592],{}," on that module, then:",[254,1011,1012],{"className":417,"code":792,"language":419,"meta":262,"style":262},[170,1013,1014],{"__ignoreMap":262},[423,1015,1016],{"class":425,"line":426},[423,1017,792],{},[175,1019,595],{"id":1020},"unmount",[15,1022,269,1023,1025,1026,1028,1029,86],{},[28,1024,595],{}," on a module, or ",[28,1027,598],{}," on a package, then ",[170,1030,1031],{},".\u002Fbyodt restart platform",[15,1033,1034],{},"The console only ever removes directories it created. A module that shipped with the release, or one you wrote yourself, is refused rather than deleted — even if the names collide.",[175,1036,1038],{"id":1037},"the-knowledge-graph-connection","The knowledge-graph connection",[15,1040,1041,1042,1044,1045,1048],{},"If your subscription includes the knowledge graph, the ",[28,1043,40],{}," tab shows one further entry above the packages: ",[28,1046,1047],{},"Knowledge graph — cloud connection",". It is not something you mount: it arrives when you connect and is removed when you disconnect. Like a content mount it is a client rather than a copy: no graph data is installed on your deployment, and every answer is served per request against your own sign-in.",[15,1050,1051,1052,1055],{},"The entry names the version your deployment is pinned to by its release date first and a shortened identifier second — for example ",[327,1053,1054],{},"Pinned to the version released 2026-09-30 (sha256:3f9a1c0be27d)",". Hover over the identifier to see it in full, or select it to copy it. Dates are always shown as year-month-day.",[15,1057,1058,1061],{},[28,1059,1060],{},"The pinned version never moves on its own."," Your deployment answers from the version it was connected at until an administrator updates it, so what your analyses draw on does not change under them.",[15,1063,1064],{},"A label beside the entry says how the pinned version compares with what the knowledge-graph service publishes:",[96,1066,1069],{"className":1067,"tabIndex":100,"role":101,"ariaLabel":1068},[99],"Table: The knowledge-graph connection",[104,1070,1071,1079],{},[107,1072,1073],{},[110,1074,1075,1077],{},[113,1076,500],{},[113,1078,827],{},[120,1080,1081,1090,1108,1121,1135],{},[110,1082,1083,1087],{},[125,1084,1085],{},[170,1086,848],{},[125,1088,1089],{},"Pinned to the newest version the service publishes.",[110,1091,1092,1097],{},[125,1093,1094],{},[170,1095,1096],{},"newer available (released 2026-10-12)",[125,1098,1099,1100,1103,1104,86],{},"A newer version is published. The entry shows what updating does and an ",[28,1101,1102],{},"Update to the 2026-10-12 version"," button — see ",[49,1105,1107],{"href":1106},"#update-the-knowledge-graph","Update the knowledge graph",[110,1109,1110,1115],{},[125,1111,1112],{},[170,1113,1114],{},"a different version is published",[125,1116,1117,1118,86],{},"The service publishes a version other than the one you are pinned to, but one of the two has no release date, so the console does not claim which is newer. The button names the published version by its release date when it has one, and by its identifier otherwise — ",[28,1119,1120],{},"Update to sha256:…",[110,1122,1123,1128],{},[125,1124,1125],{},[170,1126,1127],{},"withdrawn",[125,1129,1130,1131,86],{},"The service lists your pinned version as withdrawn. See ",[49,1132,1134],{"href":1133},"#if-the-pinned-version-is-withdrawn","If the pinned version is withdrawn",[110,1136,1137,1141],{},[125,1138,1139],{},[170,1140,871],{},[125,1142,1143,1144,86],{},"The console could not check. A line at the foot of the tab says why. Your deployment keeps answering from its pinned version as before. See ",[49,1145,1147,1148],{"href":1146},"\u002Fbyodt-cloud\u002Ftroubleshooting#the-knowledge-graph-entry-says-update-unknown","Troubleshooting → The knowledge-graph entry says ",[170,1149,871],{},[15,1151,1152,1155,1156,1158],{},[28,1153,1154],{},"How fresh this is."," The console checks when the Content tab loads and when you click ",[28,1157,694],{},". What it checks is the service's public list of versions, which is a published document that is cached on its way to you — so a version that has just been released or withdrawn can take a while to show here. The label is as current as that list, not more.",[15,1160,1161],{},"If the service cannot be reached at the moment you connect, the console says so and connects you anyway, without it. Nothing else about the connection is affected — disconnect and reconnect when you want to try again.",[175,1163,1107],{"id":1164},"update-the-knowledge-graph",[15,1166,1167,1168,1171,1172,86],{},"Updating moves your deployment to the newest knowledge-graph version the service publishes. It changes that one setting and nothing else: no module is mounted or removed, so you keep every class and every link. ",[28,1169,1170],{},"Reach for this rather than disconnecting and reconnecting",", which would cost you every cloud-provided module — see ",[49,1173,1174],{"href":922},"What disconnecting costs",[15,1176,1177,1178,86],{},"You need the administrator role. Without it the button is shown but disabled — see ",[49,1179,548],{"href":972},[239,1181,1182,1196,1215],{},[25,1183,755,1184,1186,1187,1190,1191],{},[28,1185,40],{}," tab. When a newer version is published, the knowledge-graph entry reads ",[170,1188,1189],{},"newer available (released …)"," and shows a paragraph above the button:",[286,1192,1193],{},[15,1194,1195],{},"Updating changes which version of the knowledge graph this deployment asks, and nothing else. It takes effect when you restart the platform: byodt restart platform. Until then the platform keeps answering from the version it started with, even though this page shows the new one. That restart removes no module, so it has none of the consequences for your classes and links that a restart finding a module missing does. Analyses run after it may differ from earlier ones, because the rules they draw on have changed.",[25,1197,269,1198,1200,1201,1206,1208,1209,1211,1212,1214],{},[28,1199,621],{},". There is no confirmation step, as with updating a module. The console reports what it changed beneath the button — for example:",[286,1202,1203],{},[15,1204,1205],{},"The knowledge graph is updated from the version released 2026-09-30 (sha256:3f9a1c0be27d) to the version released 2026-10-12 (sha256:8e04d27a95c1). Updating changes which version …",[264,1207],{},"The entry now shows the new version and ",[170,1210,848],{},", and the ",[28,1213,782],{}," banner appears at the top of the tab. Copy the two versions from the message into your change notes if you keep them.",[25,1216,1217,1218,1226,1228],{},"Restart the platform:",[254,1219,1220],{"className":417,"code":792,"language":419,"meta":262,"style":262},[170,1221,1222],{"__ignoreMap":262},[423,1223,1224],{"class":425,"line":426},[423,1225,792],{},[264,1227],{},"Only the platform is recreated. This restart removes no module, so it does not touch your classes or the links to them.",[15,1230,1231,1234],{},[28,1232,1233],{},"Until you restart, nothing has changed."," The Content tab shows the new version as soon as you click, because it reads the deployment's configuration — but the running platform keeps answering from the version it started with until you recreate it.",[15,1236,1237,1240],{},[28,1238,1239],{},"Analyses run after the restart may differ from earlier ones",", because the knowledge they draw on has changed. The receipt names both versions; if a comparison between analyses matters, note it together with when you restarted.",[15,1242,1243,1246,1247,86],{},[28,1244,1245],{},"If the console refuses, nothing was changed."," It updates only to the version the page showed you, and only while the service still publishes that version as its newest. If a newer one was published after the page loaded, the console says so and reloads the entry so you can see it; click the button again. The other refusals are in ",[49,1248,1250],{"href":1249},"\u002Fbyodt-cloud\u002Ftroubleshooting#content-mounts","Troubleshooting → Content mounts",[15,1252,1253],{},"There is no way to move back to an earlier version from the console. The service's newest version only ever moves forward, so the console never offers one.",[175,1255,1134],{"id":1256},"if-the-pinned-version-is-withdrawn",[15,1258,1259],{},"The knowledge-graph service can withdraw a version — for example, because something in it turned out to be wrong. When the version your deployment is pinned to is withdrawn:",[22,1261,1262,1276],{},[25,1263,1264,1267,1268,1271,1272,1275],{},[28,1265,1266],{},"The dashboard shows a warning on every tab",": ",[28,1269,1270],{},"The knowledge graph's version has been withdrawn",", with an ",[28,1273,1274],{},"Open the Content tab"," button.",[25,1277,1278,1283],{},[28,1279,1280,1281],{},"The knowledge-graph entry is labelled ",[170,1282,1127],{}," and says that, until the deployment is updated and the platform restarted, analyses may get no knowledge-graph answers.",[15,1285,1286],{},"To recover:",[239,1288,1289,1298,1303],{},[25,1290,1291,1292,1294,1295,1297],{},"On the ",[28,1293,40],{}," tab, click the ",[28,1296,621],{}," button on the knowledge-graph entry. It offers the service's newest version.",[25,1299,1300,1301,86],{},"Restart the platform: ",[170,1302,1031],{},[25,1304,1305,1308],{},[28,1306,1307],{},"Re-run the analyses that matter"," — any you ran while the withdrawn version was pinned may have had no knowledge-graph answers.",[15,1310,1311,1312,1314],{},"If the entry says the service has no other version to offer yet, there is no button: there is nothing to update to and nothing to do on your deployment yet. Click ",[28,1313,694],{}," later; when the service publishes a new version, the button appears.",[15,1316,629,1317,1319],{},[170,1318,1127],{}," label reports what the service's public version list says, and that list is cached on its way to you, as above. Whether a withdrawn version still answers is decided by the service itself, not by this label — the label tells you to act, it does not prove what a query would get.",[88,1321],{},[91,1323,1325],{"id":1324},"check-the-connection","Check the connection",[15,1327,1328],{},"Once a module is mounted and the platform recreated, three checks in the platform tell you how far the connection works. They are not steps: run them in any order. Two can pass while the third fails, which is why they are separate — each one proves one thing.",[96,1330,1333],{"className":1331,"tabIndex":100,"role":101,"ariaLabel":1332},[99],"Table: Check the connection",[104,1334,1335,1348],{},[107,1336,1337],{},[110,1338,1339,1342,1345],{},[113,1340,1341],{},"Check",[113,1343,1344],{},"How",[113,1346,1347],{},"What it proves",[120,1349,1350,1366,1385],{},[110,1351,1352,1357,1360],{},[125,1353,1354],{},[28,1355,1356],{},"The classes are there",[125,1358,1359],{},"Add an element and pick one of the module's classes.",[125,1361,1362,1365],{},[28,1363,1364],{},"Connectivity, and nothing more."," The class list comes from the public catalogue and needs no subscription.",[110,1367,1368,1373,1379],{},[125,1369,1370],{},[28,1371,1372],{},"Configuring gives the real form",[125,1374,1375,1376,246],{},"With the class picked, open the element's ",[28,1377,1378],{},"Attributes",[125,1380,1381,1384],{},[28,1382,1383],{},"Entitlement."," An entitled deployment renders the class's own form and guide; an unentitled one renders a short generic fallback.",[110,1386,1387,1392,1398],{},[125,1388,1389],{},[28,1390,1391],{},"An evaluation returns exposures",[125,1393,1394,1395,246],{},"Configure the element, then read its ",[28,1396,1397],{},"Exposures",[125,1399,1400,1403],{},[28,1401,1402],{},"That evaluation runs."," It returns exposures, or an explicit \"not evaluated\".",[15,1405,1406,1409],{},[28,1407,1408],{},"An evaluation never returns \"no findings\" when it could not evaluate."," It refuses instead, so an empty result is never a failure in disguise.",[15,1411,1412,1413,1417,1418,1420,1421,86],{},"If a check fails, the state the module is in, and what to do about it, is in ",[49,1414,1416],{"href":1415},"\u002Fbyodt-cloud\u002Ftroubleshooting#cloud-content-in-use","Troubleshooting → Cloud content in use",". Where to find the class picker and the ",[28,1419,1378],{}," tab is in ",[49,1422,1424],{"href":1423},"\u002Fplatform\u002Fcomponent-configuration-guide#how-an-element-gets-its-class","How an Element Gets Its Class",[88,1426],{},[91,1428,85],{"id":1429},"changing-who-may-sign-in",[15,1431,1432,1433,1435],{},"Who may sign in to a connected deployment is a list of accounts held in the deployment's configuration. You change that list from the console, on a running deployment, without disconnecting: section ",[28,1434,76],{}," on the Cloud tab lists your team's members with a tick beside each, and you tick the colleagues who work on this client.",[15,1437,1438,1441,1442,86],{},[28,1439,1440],{},"Reach for this rather than disconnecting."," Disconnecting also ends everyone's access, but it takes every cloud-provided module with it — and at the next platform start, the classes those modules provide and every link to them. Changing the list costs none of that. See ",[49,1443,1174],{"href":922},[15,1445,1446,1449],{},[28,1447,1448],{},"Selecting is not inviting."," The card lists people who are already on your team. Adding someone to the team, removing them, and changing roles all stay in the portal.",[175,1451,94],{"id":1452},"before-you-start-1",[96,1454,1456],{"className":1455,"tabIndex":100,"role":101,"ariaLabel":102},[99],[104,1457,1458,1466],{},[107,1459,1460],{},[110,1461,1462,1464],{},[113,1463,115],{},[113,1465,118],{},[120,1467,1468,1476,1487,1498],{},[110,1469,1470,1473],{},[125,1471,1472],{},"A connected deployment",[125,1474,1475],{},"The card appears only once a cloud configuration is written — before that the Cloud tab has steps 1 and 2 and no step 3. A deployment that is not connected admits whoever its own configuration admits, and has no access list to change.",[110,1477,1478,1481],{},[125,1479,1480],{},"The administrator role",[125,1482,1483,1484,1486],{},"The card shows your team's members and who among them may sign in, and it changes the deployment — both need an administrator of the deployment's team. See ",[49,1485,548],{"href":972},". A member who is not one sees that section's sentence and nothing of the team: no list, no ticks, nothing about who has left.",[110,1488,1489,1492],{},[125,1490,1491],{},"A deployment whose recipe names its team",[125,1493,1494,1495,86],{},"The card asks the cloud for the members of the team this deployment belongs to. A deployment connected with an older recipe does not carry its team, and the card says so instead of listing anyone — see ",[49,1496,1497],{"href":730},"When the deployment names no team",[110,1499,1500,1503],{},[125,1501,1502],{},"Your cloud sign-in in this tab",[125,1504,1505,1506,1508],{},"The card fetches your team with the cloud credential this tab holds, which a page reload clears. In a reloaded tab the card offers a ",[28,1507,707],{}," button and fetches when you return.",[175,1510,1512],{"id":1511},"the-card","The card",[239,1514,1515,1534,1549,1563,1591],{},[25,1516,1517,1518,1520,1521,1523,1524,1527,1528,1530,1531,1533],{},"In the console, select the ",[28,1519,80],{}," tab. On a connected deployment, section ",[28,1522,73],{}," has shrunk to one sentence — ",[327,1525,1526],{},"This deployment is configured for the cloud. Who may sign in to it is chosen in step 3 below; disconnecting, which reverts this configuration, is at the foot of this page."," — and below it is section ",[28,1529,76],{},", numbered like the two before it. The ",[28,1532,661],{}," section sits after it, at the foot of the tab. Above the list, the console states when a change takes effect: at the next platform start, not now.",[25,1535,1536,1537,1540,1541,1544,1545,1548],{},"The card lists ",[28,1538,1539],{},"every current member of your team by email address",", each with a tick box. ",[28,1542,1543],{},"The ticks show who may sign in today."," Your own row is marked ",[28,1546,1547],{},"(you)",": it is always ticked, and its box is greyed out. An account with no address on file is shown by its account identifier instead, and says so.",[25,1550,1551,1554,1555,1558,1559,1562],{},[28,1552,1553],{},"Tick the colleagues who work on this client, and untick the rest."," Your own row stays ticked — you cannot untick it, and hovering over the row says why: ",[327,1556,1557],{},"Your own access stays: a list that left you out would lock you out of this deployment."," A list that leaves out the person applying it would end their own access at the next platform start, so the card never offers that choice; if the new list genuinely should not include you, an administrator who ",[327,1560,1561],{},"is"," on it applies it instead.",[25,1564,269,1565,1567,1568,1575,1577,1578,1580,1581],{},[28,1566,636],{},". The console reports how many accounts it wrote and when the change takes effect — for example:",[286,1569,1570],{},[15,1571,1572],{},[170,1573,1574],{},"3 accounts written. Who may sign in changes at the next platform start, not now: the platform reads this list once, when it starts, so until then it goes on admitting exactly who it admits today — including anyone you just removed. Apply it by restarting the platform: byodt restart platform. That restart removes no module, so it has none of the consequences for your classes and links that a restart finding a module missing does.",[264,1576],{},"The number is how many you ticked. The card then fetches the team again, so the ticks show the list as written. A banner also appears at the top of ",[28,1579,632],{},", and stays there until you reload the page:",[286,1582,1583],{},[15,1584,1585,1587,1588,1590],{},[28,1586,782],{}," — Changes to who may sign in take effect when you recreate the platform: ",[170,1589,786],{},". Until then, anyone you removed can still sign in.",[25,1592,1593,1594,1602,1604],{},"Apply it:",[254,1595,1596],{"className":417,"code":792,"language":419,"meta":262,"style":262},[170,1597,1598],{"__ignoreMap":262},[423,1599,1600],{"class":425,"line":426},[423,1601,792],{},[264,1603],{},"Only the platform is recreated, and this restart removes no module — so it does not touch your classes or the links to them.",[15,1606,1607,1610,1611,1614,1615,86],{},[28,1608,1609],{},"What success looks like."," After the restart, a colleague you unticked who opens the deployment still signs in with your identity provider as before — that part is not what the list changes — and is then shown a page saying ",[28,1612,1613],{},"This deployment does not admit your account"," instead of the app. A colleague you ticked signs in and reaches the app as before. What that page says, and what to do when a colleague reports it, is under ",[49,1616,1618],{"href":1617},"#someone-the-list-does-not-admit","Someone the list does not admit",[15,1620,1621,1624,1625,1628],{},[28,1622,1623],{},"Apply writes exactly the ticks."," The list is replaced whole with the accounts you ticked, and nothing else: anyone unticked loses access at the next platform start, and there is no add-one or remove-one. Because only a current member can be ticked, applying also drops any account listed in red beneath the members (",[49,1626,731],{"href":1627},"#people-who-have-left-the-team",") — the card says so under that list.",[15,1630,1631,1634,1635,1637,1638,1640],{},[28,1632,1633],{},"Refresh."," The card reads your team when it opens and after every apply, not on its own after that. A colleague who joined the team since then appears only when you click ",[28,1636,694],{}," on the card — unticked, because a new member is not added to any deployment automatically. (This is the card's own button; the ",[28,1639,694],{}," at the top of the Content tab reads the catalog, not the team.)",[15,1642,1643,1646],{},[28,1644,1645],{},"Pending invitations are not listed."," Someone invited but not yet joined cannot be ticked until they accept in the portal.",[175,1648,1650],{"id":1649},"people-who-have-left-the-team","People who have left the team",[15,1652,1653],{},"When someone leaves your team, they do not leave this deployment's list. Leaving ends their subscription; it does not stop them signing in to a deployment that still lists them, and a signed-in person can read that client's models. The portal says as much before an owner removes someone: its confirmation warns that if the person had access to any of your deployments, they keep it until an admin updates each one — the portal cannot see your deployments, so it cannot say which.",[15,1655,1656,1657,1660],{},"So the card shows them. Beneath the members, each account on this deployment's list that no longer belongs to a team member is listed individually, in red, with ",[28,1658,1659],{},"no longer on the team"," beside it, under a line such as:",[286,1662,1663],{},[15,1664,1665],{},"2 people who have left the team can still sign in.",[15,1667,1668],{},"They are shown by account identifier rather than by address, because the address of someone who has left is kept nowhere — not by this deployment and not by the cloud — so there is nothing else to show.",[15,1670,269,1671,1673,1674,1676],{},[28,1672,639],{},". The console writes the current list with those accounts taken out, reports the count and the restart sentence as above, and raises the same ",[28,1675,782],{}," banner. Everyone still on the team is left exactly as they were — and so are any ticks you have changed but not yet applied. Then restart the platform, as in step 5.",[15,1678,1679,1682,1683,1686,1687,1690],{},[28,1680,1681],{},"The overview says the same."," While an administrator is signed in to the cloud in this tab, the console's overview carries a banner, ",[28,1684,1685],{},"People who have left the team can still sign in",", with the count and an ",[28,1688,1689],{},"Open the Cloud tab"," button. It is worked out afresh each time the page loads and never remembered: a member sees no such banner, a reloaded tab without a cloud sign-in shows none, and it goes when the team could not be fetched.",[175,1692,1694],{"id":1693},"if-you-are-sent-to-sign-in","If you are sent to sign in",[15,1696,1697],{},"If your cloud sign-in in this tab lapses at the moment you apply, the console takes you to sign in again. That interrupts the change rather than making it. When you return the card shows:",[286,1699,1700],{},[15,1701,1702],{},"You were signed in again before this could be applied, so nothing was changed. What you had chosen is below — check it and apply again.",[15,1704,1705],{},"Your ticks are put back as you left them, over the team fetched afresh; a tick for someone who has left the team in the meantime is dropped. The console keeps the ticks — account identifiers — across that redirect, and never the addresses.",[175,1707,1497],{"id":1708},"when-the-deployment-names-no-team",[15,1710,1711],{},"A deployment connected with an older recipe does not tell the console which team it belongs to. The card cannot list the team, and says so:",[286,1713,1714],{},[15,1715,1716],{},"This deployment's recipe predates team identifiers, so the console cannot tell which team it belongs to — and without that it will show neither the team nor who may sign in. Nothing was changed. Regenerate the deployment recipe in the portal and reconnect — see what disconnecting costs before you do.",[15,1718,1719,1720,1722,1723,1726],{},"The lasting fix is a fresh recipe: get one from the portal, ",[49,1721,923],{"href":922},", apply it, and connect again — read what disconnecting costs first. Until then, the card offers a paste box beneath that sentence, and ",[28,1724,1725],{},"on this deployment only"," you replace the list by pasting it. This is the one place the console cannot show you the current list, so copy the whole list rather than editing from memory.",[15,1728,1729,1732,1733,1736,1737,1740,1741,1743],{},[28,1730,1731],{},"The list is a line of the recipe."," The portal has no separate list to copy: the recipe that connected this deployment carries it, as the ",[170,1734,1735],{},"DEPLOYMENT_ALLOWLIST="," line of the ",[28,1738,1739],{},"Environment"," block on the portal's deployment page — the page ",[28,1742,344],{}," opens. The recipe is built from the team's current members each time that page shows it, so the line is current when you read it, even though the one your deployment holds is not.",[15,1745,1746,1747,1750],{},"Some of the console's messages call these accounts ",[327,1748,1749],{},"subjects",". They are the identifiers your identity provider issues, and they are what that line holds, separated by commas.",[239,1752,1753,1769,1772,1780],{},[25,1754,1755,1756,1758,1759,1761,1762,1765,1766,1768],{},"In the portal, open the deployment page and find the ",[170,1757,1735],{}," line in the ",[28,1760,1739],{}," block. Copy its value — everything after the ",[170,1763,1764],{},"=",", to the end of that line, and nothing else. The block's ",[28,1767,272],{}," button copies the whole recipe, which is not what the box wants.",[25,1770,1771],{},"Paste it into the box. One account per line, or separated by commas — the line's own commas are fine as they are.",[25,1773,269,1774,1776,1777,1779],{},[28,1775,643],{},". The box clears, and the console reports how many accounts it wrote and when the change takes effect, in the same words as step 4 above — and raises the same ",[28,1778,782],{}," banner.",[25,1781,1782],{},"Restart the platform, as in step 5 above.",[15,1784,1785,1788,1789,1792,1793,1795,1796,86],{},[28,1786,1787],{},"The count is the only confirmation you get."," A successful apply answers with a number — ",[170,1790,1791],{},"12 accounts written"," — and on this deployment that number is all there is: the console reports the number and never the accounts themselves, it cannot show you the list you replaced, and it clears the box on success, so there is nothing left on screen to check against. So count the identifiers in the line before you paste it, and compare. If the console's number is lower, the paste lost something: copy the value again and apply it again ",[28,1794,215],{}," you restart. Nothing has taken effect until you do. If you need to check what is actually configured, it is readable on the host: ",[49,1797,1799],{"href":1798},"\u002Fbyodt-cloud\u002Ftroubleshooting#i-need-to-see-who-is-on-the-access-list","Troubleshooting → I need to see who is on the access list",[175,1801,1803],{"id":1802},"what-the-console-will-and-will-not-accept","What the console will and will not accept",[22,1805,1806,1812,1822,1839,1845],{},[25,1807,1808,1811],{},[28,1809,1810],{},"It replaces the whole list."," Whether you apply ticks or a paste, anyone not on it loses access at the next platform start. There is no add-one or remove-one.",[25,1813,1814,1817,1818,1821],{},[28,1815,1816],{},"It refuses a list that leaves you out",", because applying it would lock you out of your own deployment at the next platform start. The card cannot produce this refusal — your own row stays ticked there — so you only meet it from the paste box, and its sentence is written for that: paste the recipe's ",[170,1819,1820],{},"DEPLOYMENT_ALLOWLIST"," value from a freshly generated deployment recipe again rather than adding yourself back to what is in the box — if your own account was missing from what you pasted, others may be too. An administrator who is on the new list can also apply it for you.",[25,1823,1824,1827,1828,1831,1832,1835,1836,1838],{},[28,1825,1826],{},"It refuses an empty list."," An empty list does not mean \"nobody\": the platform reads it as ",[327,1829,1830],{},"no restriction",", and on a deployment reachable over the network it refuses to start at all. The card lets you apply with nobody ticked so that you read this refusal rather than a greyed-out button; a paste that looks filled can still name none — separators on their own, such as ",[170,1833,1834],{},",,,",", are not accounts. To narrow access to one person, apply a list naming that one account. If that person is not you, that list leaves you out: on the card your own row stays ticked beside theirs, and in the paste box the console refuses it, for the reason in the bullet above — keep your own account on it as well, or ask an administrator who ",[327,1837,1561],{}," on the new list to apply it.",[25,1840,1841,1844],{},[28,1842,1843],{},"It changes nothing else."," Only who may sign in. Every other value in the deployment's configuration is left exactly as it was.",[25,1846,1847,1850,1851,86],{},[28,1848,1849],{},"A refusal changes nothing."," The message names which refusal it is; each one, and what to do about it, is in ",[49,1852,718],{"href":717},[175,1854,1856],{"id":1855},"until-you-restart","Until you restart",[15,1858,1859,1860,1862],{},"The change is written, and it is inert. The platform reads its access list once, when it starts, so until you run ",[170,1861,1031],{}," the deployment goes on admitting exactly who it admitted before — including anyone you just removed. The console states this before you submit anything, and again in the answer. If access has to end now, restart the platform now.",[15,1864,1865,1868,1869,53,1871,1873,1874,1876,1877,1879,1880,1882],{},[28,1866,1867],{},"The reminder stays."," After any successful write — ",[28,1870,636],{},[28,1872,639],{},", or ",[28,1875,643],{}," — a banner at the top of ",[28,1878,632],{}," reads ",[28,1881,782],{}," and names the command, like the one the Content tab shows after a mount. It stays for as long as the page is open, however many times the card refreshes, because the console cannot see you run the command; reloading the page clears it, and so does disconnecting, which owes a restart of its own. A refused write raises no banner, since nothing was written.",[15,1884,1885,1888],{},[28,1886,1887],{},"The deployment never keeps the addresses."," They are fetched when the card opens and held only while it is open — never written to the deployment's disk, its configuration, its logs, or your browser's storage. Reopening the card fetches them again.",[175,1890,1618],{"id":1891},"someone-the-list-does-not-admit",[15,1893,1894],{},"Once the platform has restarted, a person whose account is not on the list still signs in with your identity provider exactly as before — the list is read by the platform, not by the identity provider, so the sign-in itself succeeds. What they then see, instead of the app, is a page with the heading:",[286,1896,1897],{},[15,1898,1899],{},[28,1900,1613],{},[15,1902,1903,1904,1907,1908,1911],{},"It tells them their sign-in worked, names the account it worked as, and says that who may sign in is chosen by an administrator of the team this deployment belongs to, on the deployment's console, and that the change takes effect when the platform is restarted. It offers two buttons: ",[28,1905,1906],{},"Check again",", which tries the app once more, and ",[28,1909,1910],{},"Sign out",". It does not send them back to sign in, because their sign-in is not the problem.",[15,1913,1914],{},"A sign-in that has merely expired does not show this page. The app renews it without a word, and if it cannot, sends the person to the ordinary sign-in. The page appears only when a freshly renewed sign-in is refused too.",[15,1916,1917],{},"So when a colleague reports that page, the deployment is doing what its list says. If they should have access:",[239,1919,1920,1930,1936,1940],{},[25,1921,1291,1922,1924,1925,1927,1928,86],{},[28,1923,632],{}," card, tick their row and click ",[28,1926,636],{}," — or, on a deployment that names no team, paste a list that includes them and click ",[28,1929,643],{},[25,1931,1932,1933,1935],{},"Read the count the console reports, and the ",[28,1934,782],{}," banner it raises.",[25,1937,1300,1938,86],{},[170,1939,1031],{},[25,1941,1942,1943,1945],{},"Ask them to click ",[28,1944,1906],{},". The same sign-in is admitted now, so they reach the app without signing in again — unless their session expired in the meantime, in which case the ordinary sign-in follows and then admits them.",[15,1947,1948,1949,1952],{},"If they are not on your team, add them to the team in the portal first — ",[49,1950,1951],{"href":84},"selecting is not inviting"," — then tick them.",[88,1954],{},[91,1956,989],{"id":1957},"disconnecting",[15,1959,1960,1961,1964],{},"Disconnecting rewrites the deployment's configuration back to the standalone values and removes every module the cloud provided. ",[28,1962,1963],{},"Your models and diagrams are not deleted"," — what a disconnect costs is the classes those modules contributed, and every link to them.",[286,1966,1967],{},[15,1968,1969,1972],{},[28,1970,1971],{},"What disconnecting costs."," Every cloud-provided module goes with the connection that justified it — mounted content modules, installed artifacts and the knowledge-graph connection. At the next platform restart the classes those modules provided are deleted, together with every link to them, including the links in analyses you have already run; reconnecting and mounting them again brings the classes back, but not those links. Anything you authored outside those classes is kept. Unmounting first is not a way around this — a module the platform no longer finds loses its classes however it left — and the console states the same cost in the confirmation it asks you to accept. The knowledge-graph connection is the exception: it declares no classes, so nothing follows from removing it.",[239,1974,1975,2001,2015],{},[25,1976,1517,1977,1979,1980,1982,1983,1987,1989,1990,1992,1993,1995,1996],{},[28,1978,80],{}," tab. Section ",[28,1981,73],{}," now reads:",[286,1984,1985],{},[15,1986,1526],{},[264,1988],{},"Scroll past section ",[28,1991,76],{}," to the ",[28,1994,661],{}," section at the foot of the tab. It carries no step number, because disconnecting is not a step of setting the deployment up — it undoes step 2 — and it reads:",[286,1997,1998],{},[15,1999,2000],{},"Disconnect rewrites the configuration back to the pure open-source values and removes the modules the cloud provided; the change is applied by recreating the stack.",[25,2002,269,2003,2005,2006,2008,2009],{},[28,2004,655],{},". The console asks you to confirm, listing what the disconnect removes; click ",[28,2007,661],{}," to accept. It then reports:",[254,2010,2013],{"className":2011,"code":2012,"language":259},[257],"reverted to pure-OSS; apply it by recreating the stack: byodt restart\n",[170,2014,2012],{"__ignoreMap":262},[25,2016,2017,2018],{},"Recreate the stack:",[254,2019,2020],{"className":417,"code":418,"language":419,"meta":262,"style":262},[170,2021,2022],{"__ignoreMap":262},[423,2023,2024],{"class":425,"line":426},[423,2025,418],{},[15,2027,2028,2029,86],{},"Until you do, the console shows a banner reading ",[28,2030,2031],{},"Revert to pure open-source not yet applied",[15,2033,2034,2035,2038,2039,2041],{},"The console signs you out here too, but this direction is smoother: the posture is now standalone, so the console re-establishes its own session and opens straight to the dashboard. After the recreate, the badge reads ",[28,2036,2037],{},"Pre-cloud"," again and the ",[28,2040,40],{}," tab is gone.",[286,2043,2044,2053,2056],{},[15,2045,2046,2049,2050,2052],{},[28,2047,2048],{},"Disconnecting contacts the cloud, and can be refused."," It changes the deployment, so it is administrator-only like the other controls in ",[49,2051,548],{"href":972},", and the check is made live on the attempt — which means a disconnect is refused while the check cannot be made. That is deliberate on the one operation that costs you classes and links: it fails by declining, never by proceeding.",[15,2054,2055],{},"Two narrower guarantees do hold, and they are the ones to rely on:",[22,2057,2058,2064],{},[25,2059,2060,2063],{},[28,2061,2062],{},"A session you already hold keeps the ability to revert while the platform is down."," The platform and the content service are separate dependencies, and this check asks only the second — so a platform that will not come up does not take disconnect with it.",[25,2065,2066,2069],{},[28,2067,2068],{},"A deployment whose configuration can never obtain the credential the check needs is not locked in."," Disconnect alone proceeds there, because disconnect is what you reach for to fix a bad configuration. Nothing else on the list gets that carve-out.",[88,2071],{},[91,2073,2075],{"id":2074},"what-the-console-will-and-will-not-do-with-a-recipe","What the console will and will not do with a recipe",[15,2077,2078],{},"Worth knowing, because it explains the messages you may see.",[22,2080,2081,2087,2093,2099,2105,2118],{},[25,2082,2083,2086],{},[28,2084,2085],{},"It accepts a fixed set of variable names, and refuses the whole recipe if anything else appears."," It lists what it refused. This is a deliberate guard: the configuration it writes is applied over the platform's own settings, so an unexpected variable in it could change far more than identity.",[25,2088,2089,2092],{},[28,2090,2091],{},"It requires every expected variable to be present and non-empty."," A half-applied recipe would boot the deployment into a broken state, so it is refused outright.",[25,2094,2095,2098],{},[28,2096,2097],{},"It keeps your deployment's own exposure declaration"," rather than taking the recipe's, and says so when it does.",[25,2100,2101,2104],{},[28,2102,2103],{},"It supplies the values a recipe cannot know"," — the callback address of your front door, and where cached content lives.",[25,2106,2107,2110,2111,2113,2114,2117],{},[28,2108,2109],{},"It refuses to reconfigure a deployment that is already connected."," Disconnect first, then apply the new recipe. There are exactly two exceptions, and neither is a recipe: ",[49,2112,558],{"href":84}," can be changed in place on a connected deployment, from the card, and so can ",[49,2115,2116],{"href":1106},"the knowledge-graph version",", from the Content tab — to the version the service publishes as newest, and no other. No other value can.",[25,2119,2120,2123,2124,86],{},[28,2121,2122],{},"It will not write a plaintext identity endpoint or a non-local plaintext callback."," Those must be HTTPS, or ",[170,2125,172],{},[88,2127],{},[91,2129,2131],{"id":2130},"troubleshooting","Troubleshooting",[15,2133,2134,2135,53,2137,301,2140,86],{},"Cloud-specific symptoms — a rejected callback, a sign-in that will not complete, a refused administrator check, a team the card could not fetch, a rejected access list, an unreachable catalog, a class that shows a generic form, a refused evaluation — are covered in ",[49,2136,718],{"href":717},[49,2138,2139],{"href":1249},"Content mounts",[49,2141,2142],{"href":1415},"Cloud content in use",[91,2144,2146],{"id":2145},"related","Related",[22,2148,2149,2156],{},[25,2150,2151,2155],{},[49,2152,2154],{"href":2153},"\u002Fbyodt-cloud\u002Foperations","Operations"," — the commands referenced here, including TLS.",[25,2157,2158,2162],{},[49,2159,2161],{"href":2160},"\u002Fbyodt-cloud\u002Fconfiguration#the-mode-layer-modemodeenv","Configuration"," — the mode layer the console writes.",[2164,2165,2166],"style",{},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":262,"searchDepth":2168,"depth":2168,"links":2169},3,[2170,2175,2176,2177,2178,2179,2180,2190,2191,2201,2202,2203,2204],{"id":93,"depth":2171,"text":94,"children":2172},2,[2173,2174],{"id":177,"depth":2168,"text":178},{"id":219,"depth":2168,"text":220},{"id":236,"depth":2171,"text":237},{"id":336,"depth":2171,"text":337},{"id":410,"depth":2171,"text":411},{"id":452,"depth":2171,"text":453},{"id":547,"depth":2171,"text":548},{"id":737,"depth":2171,"text":738,"children":2181},[2182,2183,2184,2185,2186,2187,2188,2189],{"id":749,"depth":2168,"text":750},{"id":811,"depth":2168,"text":812},{"id":975,"depth":2168,"text":694},{"id":998,"depth":2168,"text":999},{"id":1020,"depth":2168,"text":595},{"id":1037,"depth":2168,"text":1038},{"id":1164,"depth":2168,"text":1107},{"id":1256,"depth":2168,"text":1134},{"id":1324,"depth":2171,"text":1325},{"id":1429,"depth":2171,"text":85,"children":2192},[2193,2194,2195,2196,2197,2198,2199,2200],{"id":1452,"depth":2168,"text":94},{"id":1511,"depth":2168,"text":1512},{"id":1649,"depth":2168,"text":1650},{"id":1693,"depth":2168,"text":1694},{"id":1708,"depth":2168,"text":1497},{"id":1802,"depth":2168,"text":1803},{"id":1855,"depth":2168,"text":1856},{"id":1891,"depth":2168,"text":1618},{"id":1957,"depth":2171,"text":989},{"id":2074,"depth":2171,"text":2075},{"id":2130,"depth":2171,"text":2131},{"id":2145,"depth":2171,"text":2146},"Add cloud sign-in and content packages from the operator console, and disconnect again","md",{"category":2208,"position":2209,"tags":2210},"documentation",5,[2211,2212,2213,2214,2215,2216],"byodt","deployment","cloud","sso","content","modules",true,"\u002Fbyodt-cloud\u002Fcloud",{"title":5,"description":2205},"02.byodt-cloud\u002F04.cloud","DPdeFBW36gU3d1O6SFO33lSAprYOuWAdWpwvSI2iX78",[2223,2278,2308,2363,2397,2441,2456,2526],{"title":2224,"description":2225,"path":2226,"stem":2227,"children":2228,"page":-1},"Platform","Modelling, analysis, findings and controls in the Dethernety platform.","\u002Fplatform","01.platform",[2229,2233,2238,2243,2248,2253,2258,2263,2268,2273],{"title":2230,"path":2226,"stem":2231,"description":2232},"Dethernety User Documentation","01.platform\u002Findex","User guide for the Dethernety threat modeling platform",{"title":2234,"path":2235,"stem":2236,"description":2237},"Quick Start","\u002Fplatform\u002Fquick-start","01.platform\u002F01.quick-start","Install Dethernety on your own machine, draw a four-element model and read its first threat finding.",{"title":2239,"path":2240,"stem":2241,"description":2242},"Building Your First Model","\u002Fplatform\u002Fbuilding-your-first-model","01.platform\u002F02.building-your-first-model","Build a threat model of an online store in about 30 minutes, run a Threat Report on it, and raise an issue from a finding.",{"title":2244,"path":2245,"stem":2246,"description":2247},"Security Analysis Workflow","\u002Fplatform\u002Fsecurity-analysis-workflow","01.platform\u002F03.security-analysis-workflow","How to run security analysis and interpret results to improve your threat models.",{"title":2249,"path":2250,"stem":2251,"description":2252},"Managing Findings","\u002Fplatform\u002Fmanaging-findings","01.platform\u002F04.managing-findings","Record decisions on system-generated exposures and countermeasures — affirm them as confirmed live risk, or mute them as not applicable, false positive, waived, or superseded — instead of deleting them.",{"title":2254,"path":2255,"stem":2256,"description":2257},"Working with Security Controls","\u002Fplatform\u002Fworking-with-security-controls","01.platform\u002F05.working-with-security-controls","Learn how to create, manage, and assign reusable security controls in Dethernety to protect your threat models.",{"title":2259,"path":2260,"stem":2261,"description":2262},"Issue Management Guide","\u002Fplatform\u002Fissue-management-guide","01.platform\u002F06.issue-management-guide","Issue tracking, filtering, and management in Dethernety.",{"title":2264,"path":2265,"stem":2266,"description":2267},"Boundary Trust Zones","\u002Fplatform\u002Fboundary-trust-zones","01.platform\u002F07.boundary-trust-zones","Record each security boundary's trust zone, business domains, operational role, and approved channels to document how your system is meant to be segmented.",{"title":2269,"path":2270,"stem":2271,"description":2272},"Understanding Modules","\u002Fplatform\u002Funderstanding-modules","01.platform\u002F08.understanding-modules","How Dethernety's module system extends your threat modeling capabilities.",{"title":2274,"path":2275,"stem":2276,"description":2277},"Component Configuration Guide","\u002Fplatform\u002Fcomponent-configuration-guide","01.platform\u002F09.component-configuration-guide","Detailed guide on configuring different types of components and their security implications.",{"title":2279,"description":2280,"path":2281,"stem":2282,"children":2283,"page":-1},"BYODt cloud","Deploying the platform yourself and connecting it to the BYODt cloud.","\u002Fbyodt-cloud","02.byodt-cloud",[2284,2288,2293,2298,2302,2303],{"title":2285,"path":2281,"stem":2286,"description":2287},"BYODt Deployment","02.byodt-cloud\u002Findex","Run Dethernety on your own machine: install, configure, operate, and recover",{"title":2289,"path":2290,"stem":2291,"description":2292},"Installing the BYODt Deployment","\u002Fbyodt-cloud\u002Finstallation","02.byodt-cloud\u002F01.installation","Install Dethernety on your own machine: check the requirements, download and verify the signed bundle, start it, and confirm the deployment is healthy",{"title":2294,"path":2295,"stem":2296,"description":2297},"Configuring the BYODt Deployment","\u002Fbyodt-cloud\u002Fconfiguration","02.byodt-cloud\u002F02.configuration","The .env settings reference, the generated secret file, database storage, and how to apply a change",{"title":2299,"path":2153,"stem":2300,"description":2301},"Operating the BYODt Deployment","02.byodt-cloud\u002F03.operations","The byodt command reference and the day-to-day tasks: start, stop, inspect, back up, restore, TLS, upgrade, remove",{"title":5,"path":2218,"stem":2220,"description":2205},{"title":2304,"path":2305,"stem":2306,"description":2307},"Troubleshooting the BYODt Deployment","\u002Fbyodt-cloud\u002Ftroubleshooting","02.byodt-cloud\u002F05.troubleshooting","Symptom, cause, and fix for the failures this deployment reports",{"title":2309,"description":2310,"path":2311,"stem":2312,"children":2313,"page":-1},"Dethereal","The Claude Code plugin: build a threat model in conversation and publish it to the platform.","\u002Fdethereal","03.dethereal",[2314,2318,2323,2328,2333,2338,2343,2348,2353,2358],{"title":2315,"path":2311,"stem":2316,"description":2317},"Dethereal — Claude Code Plugin for Threat Modeling","03.dethereal\u002Findex","Comprehensive documentation for the Dethereal threat modeling plugin",{"title":2319,"path":2320,"stem":2321,"description":2322},"Getting Started with Dethereal","\u002Fdethereal\u002Fgetting-started","03.dethereal\u002F01.getting-started","Install the plugin, authenticate, and create your first threat model",{"title":2324,"path":2325,"stem":2326,"description":2327},"The 11-Step Guided Workflow","\u002Fdethereal\u002Fguided-workflow","03.dethereal\u002F02.guided-workflow","Complete walkthrough of the \u002Fdethereal:threat-model guided process",{"title":2329,"path":2330,"stem":2331,"description":2332},"Command Reference","\u002Fdethereal\u002Fcommand-reference","03.dethereal\u002F03.command-reference","Complete reference for all 14 Dethereal slash commands",{"title":2334,"path":2335,"stem":2336,"description":2337},"Threat Model Concepts","\u002Fdethereal\u002Fmodel-concepts","03.dethereal\u002F04.model-concepts","Components, boundaries, data flows, classes, attributes, and quality scoring",{"title":2339,"path":2340,"stem":2341,"description":2342},"Discovery and Enrichment","\u002Fdethereal\u002Fdiscovery-and-enrichment","03.dethereal\u002F05.discovery-and-enrichment","Infrastructure scanning, security attributes, MITRE ATT&CK, credentials, and compliance",{"title":2344,"path":2345,"stem":2346,"description":2347},"Sync and Version Control","\u002Fdethereal\u002Fsync-and-version-control","03.dethereal\u002F06.sync-and-version-control","Push\u002Fpull workflow, conflict handling, git integration, and multi-model projects",{"title":2349,"path":2350,"stem":2351,"description":2352},"Review and Attack Surface Analysis","\u002Fdethereal\u002Freview-and-analysis","03.dethereal\u002F07.review-and-analysis","Quality review, attack surface summary, and platform analysis integration",{"title":2354,"path":2355,"stem":2356,"description":2357},"Agents, Tools, and Hooks","\u002Fdethereal\u002Fagents-and-architecture","03.dethereal\u002F08.agents-and-architecture","How the 5 AI agents, 22 MCP tools, and 3 lifecycle hooks work together",{"title":2359,"path":2360,"stem":2361,"description":2362},"Dethereal Glossary","\u002Fdethereal\u002Fglossary","03.dethereal\u002F09.glossary","Definitions for Dethereal-specific terminology",{"title":2364,"description":2365,"path":2366,"stem":2367,"children":2368,"page":-1},"Threat Report","The residual-risk report over a threat model: reading it, filtering it and exporting it.","\u002Fthreat-report","04.threat-report",[2369,2372,2377,2382,2387,2392],{"title":2364,"path":2366,"stem":2370,"description":2371},"04.threat-report\u002Findex","Read, filter, drill into, and export a residual-risk report over a threat model",{"title":2373,"path":2374,"stem":2375,"description":2376},"Getting Started with the Threat Report","\u002Fthreat-report\u002Fgetting-started","04.threat-report\u002F01.getting-started","Generate, open, refresh, and export a threat report over a model",{"title":2378,"path":2379,"stem":2380,"description":2381},"Reading the Report","\u002Fthreat-report\u002Freading-the-report","04.threat-report\u002F02.reading-the-report","Navigating the report, the shared visual language, and the Posture and Boundary Crossings views",{"title":2383,"path":2384,"stem":2385,"description":2386},"Understanding Coverage and Gaps","\u002Fthreat-report\u002Funderstanding-coverage","04.threat-report\u002F03.understanding-coverage","Reading the MITRE ATT&CK coverage matrix: tiers, prevent vs detect, off-grid notes, and what coverage does and does not mean",{"title":2388,"path":2389,"stem":2390,"description":2391},"Reachability and Flow Routes","\u002Fthreat-report\u002Freachability","04.threat-report\u002F04.reachability","Exploring flow routes to crown-jewel assets and between any two elements — and what the analysis does and does not model",{"title":2393,"path":2394,"stem":2395,"description":2396},"Working with Findings","\u002Fthreat-report\u002Fworking-with-findings","04.threat-report\u002F05.working-with-findings","The Residual Risk ledger, triaging findings, filtering, and the per-element Component Profile",{"title":2398,"description":2399,"path":2400,"stem":2401,"children":2402,"page":-1},"Risk assessment","The risk assessment module: the register, the reports and the method behind them.","\u002Frisk-assessment","05.risk-assessment",[2403,2407,2412,2417,2422,2427,2431,2436],{"title":2404,"path":2400,"stem":2405,"description":2406},"Dethernety Risk Assessment User Guide","05.risk-assessment\u002Findex","Dethernety Risk Assessment turns a threat model you have built on the Dethernety platform into a grounded, board-ready draft risk report. From one point-in-time assessment of your model you get a prioritized worklist, a likelihood × impact risk matrix, a security-coverage posture, ten kinds of finding, a management risk register your team authors and maintains, and audience-tiered stakeholder reports — Board, Risk Committee, and Technical — plus machine-readable data exports.",{"title":2408,"path":2409,"stem":2410,"description":2411},"FAQ and Troubleshooting","\u002Frisk-assessment\u002Ffaq","05.risk-assessment\u002F01.faq","Short answers to the questions analysts, risk managers, and compliance officers ask most often about the Risk Assessment. Each answer links to the guide that covers it in full.",{"title":2413,"path":2414,"stem":2415,"description":2416},"Findings","\u002Frisk-assessment\u002Ffindings","05.risk-assessment\u002F02.findings","A finding is a specific observation the Risk Assessment makes about your threat model. Every finding is grounded in something concrete you have declared — an element, a data flow, a trust zone, a crown jewel — and it points you at a place worth a closer look. This guide is the reference to open when you see a finding and want to know what it means and what to do about it.",{"title":2418,"path":2419,"stem":2420,"description":2421},"Getting Started","\u002Frisk-assessment\u002Fgetting-started","05.risk-assessment\u002F03.getting-started","Risk Assessment turns a threat model you have built on the Dethernety platform into a grounded, board-ready draft risk report — a prioritized worklist, a likelihood × impact matrix, a security-coverage posture, ten kinds of finding, a risk register your team authors, and audience-tiered stakeholder reports and exports.",{"title":2423,"path":2424,"stem":2425,"description":2426},"Methodology and Trust","\u002Frisk-assessment\u002Fmethodology-and-trust","05.risk-assessment\u002F04.methodology-and-trust","Every number in a Risk Assessment is meant to survive scrutiny. This chapter explains why you can trust the report and — just as importantly — what it deliberately declines to claim, so you can put it in front of your board, a regulator, or an external auditor and defend every line.",{"title":2378,"path":2428,"stem":2429,"description":2430},"\u002Frisk-assessment\u002Freading-the-report","05.risk-assessment\u002F05.reading-the-report","The Risk Assessment turns your threat model into a single, scannable draft risk report: an executive summary at the top and a set of analytical tabs below it. This guide explains how to read what you see — what a matrix cell means, how coverage is stated, what a severity band is (and is not), and how to interpret each tab.",{"title":2432,"path":2433,"stem":2434,"description":2435},"Stakeholder Reports and Exports","\u002Frisk-assessment\u002Fstakeholder-reports","05.risk-assessment\u002F06.stakeholder-reports","One assessment produces reporting for every audience you answer to. From a single generated Risk Assessment you can hand your board a one-page brief, give your risk committee the full reconciliation, keep the complete technical detail for your own team, and export the underlying data into your GRC tool — without ever re-running anything or reconciling one document against another.",{"title":2437,"path":2438,"stem":2439,"description":2440},"The Risk Register","\u002Frisk-assessment\u002Fthe-risk-register","05.risk-assessment\u002F07.the-risk-register","The Risk Register is where your team records and manages the real risks your organisation is carrying — on top of, but separate from, what the analysis computed for you. Each entry is written by a person: a plain-language risk statement, your own assessment of how likely it is and how much it would hurt, the findings and elements from the analysis that back it up, a treatment decision, an owner, a review date, and a reference handle you can quote in a ticket or a board pack.",{"title":2442,"description":2443,"path":2444,"stem":2445,"children":2446,"page":-1},"Threat Patterns","The Threat Patterns module and its modelling checklist.","\u002Fthreat-patterns","06.threat-patterns",[2447,2451],{"title":2448,"path":2444,"stem":2449,"description":2450},"Threat Patterns User Guide","06.threat-patterns\u002Findex","Threat Patterns finds threats in your model that no single element shows on its own. Each one appears only when several elements line up. For example, an agent may read content anyone can write, hold private data, and be able to send data where an outsider reads it. Each element can look acceptable alone, but together they form a path an attacker can use.",{"title":2452,"path":2453,"stem":2454,"description":2455},"Modelling Checklist","\u002Fthreat-patterns\u002Fmodelling-checklist","06.threat-patterns\u002F01.modelling-checklist","Threat Patterns decides a leg only from what your model states. An unanswered attribute or field is undetermined, never read as \"no\". This checklist lists the facts and drawings the analysis asks for most often. For each one it says where to set it and which leg it settles. Attribute names are shown as they appear on the class, in code.",{"title":2457,"description":2458,"path":2459,"stem":2460,"children":2461,"page":-1},"Agentic modelling","A hands-on training: model one agentic system step by step, with Threat Patterns after each step.","\u002Fagentic-modelling","07.agentic-modelling",[2462,2466,2471,2476,2481,2486,2491,2496,2501,2506,2511,2516,2521],{"title":2463,"path":2459,"stem":2464,"description":2465},"Model an Agentic Architecture","07.agentic-modelling\u002Findex","A hands-on training in modelling systems that run AI agents, so that Threat Patterns can analyse them. You build one system, a fictional customer-support copilot, in eleven short lessons. Each lesson adds one thing to the model, and you run Threat Patterns after each one to see what the change did.",{"title":2467,"path":2468,"stem":2469,"description":2470},"Lesson 1: Draw the Agent and What It Talks To","\u002Fagentic-modelling\u002F01-draw-the-agent","07.agentic-modelling\u002F01.01-draw-the-agent","Training overview · Lesson 1 of 11 · Next: Say what data moves",{"title":2472,"path":2473,"stem":2474,"description":2475},"Lesson 2: Say What Data Moves","\u002Fagentic-modelling\u002F02-say-what-data-moves","07.agentic-modelling\u002F02.02-say-what-data-moves","Training overview · Lesson 2 of 11 · Previous: Draw the agent · Next: Mark who is outside",{"title":2477,"path":2478,"stem":2479,"description":2480},"Lesson 3: Mark Who Is Outside","\u002Fagentic-modelling\u002F03-mark-who-is-outside","07.agentic-modelling\u002F03.03-mark-who-is-outside","Training overview · Lesson 3 of 11 · Previous: Say what data moves · Next: Draw a tool that reaches any host",{"title":2482,"path":2483,"stem":2484,"description":2485},"Lesson 4: Draw a Tool That Reaches Any Host","\u002Fagentic-modelling\u002F04-draw-a-tool-that-reaches-any-host","07.agentic-modelling\u002F04.04-draw-a-tool-that-reaches-any-host","Training overview · Lesson 4 of 11 · Previous: Mark who is outside · Next: State what the agent can do",{"title":2487,"path":2488,"stem":2489,"description":2490},"Lesson 5: State What the Agent Can Do","\u002Fagentic-modelling\u002F05-state-what-the-agent-can-do","07.agentic-modelling\u002F05.05-state-what-the-agent-can-do","Training overview · Lesson 5 of 11 · Previous: Draw a tool that reaches any host · Next: Fix a finding with a fact",{"title":2492,"path":2493,"stem":2494,"description":2495},"Lesson 6: Fix a Finding With a Fact","\u002Fagentic-modelling\u002F06-fix-a-finding-with-a-fact","07.agentic-modelling\u002F06.06-fix-a-finding-with-a-fact","Training overview · Lesson 6 of 11 · Previous: State what the agent can do · Next: Record a compensating control",{"title":2497,"path":2498,"stem":2499,"description":2500},"Lesson 7: Record a Compensating Control","\u002Fagentic-modelling\u002F07-record-a-compensating-control","07.agentic-modelling\u002F07.07-record-a-compensating-control","Training overview · Lesson 7 of 11 · Previous: Fix a finding with a fact · Next: Leave what you don't know open",{"title":2502,"path":2503,"stem":2504,"description":2505},"Lesson 8: Leave What You Don't Know Open","\u002Fagentic-modelling\u002F08-leave-unknowns-open","07.agentic-modelling\u002F08.08-leave-unknowns-open","Training overview · Lesson 8 of 11 · Previous: Record a compensating control · Next: Follow a credential",{"title":2507,"path":2508,"stem":2509,"description":2510},"Lesson 9: Follow a Credential","\u002Fagentic-modelling\u002F09-follow-a-credential","07.agentic-modelling\u002F09.09-follow-a-credential","Training overview · Lesson 9 of 11 · Previous: Leave what you don't know open · Next: Watch what gets into knowledge and memory",{"title":2512,"path":2513,"stem":2514,"description":2515},"Lesson 10: Watch What Gets Into Knowledge and Memory","\u002Fagentic-modelling\u002F10-what-gets-in","07.agentic-modelling\u002F10.10-what-gets-in","Training overview · Lesson 10 of 11 · Previous: Follow a credential · Next: Draw tools from others and hand-offs",{"title":2517,"path":2518,"stem":2519,"description":2520},"Lesson 11: Draw Tools From Others and Hand-offs","\u002Fagentic-modelling\u002F11-tools-and-handoffs","07.agentic-modelling\u002F11.11-tools-and-handoffs","Training overview · Lesson 11 of 11 · Previous: Watch what gets into knowledge and memory",{"title":2522,"path":2523,"stem":2524,"description":2525},"The recipe at a glance","\u002Fagentic-modelling\u002Frecipe-at-a-glance","07.agentic-modelling\u002F12.recipe-at-a-glance","The ten steps of the training on one page. Each lesson teaches one or two of them.",{"title":152,"description":2527,"path":2528,"stem":2529,"children":2530,"page":-1},"Subscribing on the BYODt Portal, and moving a deployment you already run to a new team.","\u002Fbyodt-subscription","08.byodt-subscription",[2531,2535,2540],{"title":2532,"path":2528,"stem":2533,"description":2534},"BYODt Subscription","08.byodt-subscription\u002Findex","Buy content for the deployment you run yourself, and decide where that deployment goes when you buy a team edition",{"title":2536,"path":2537,"stem":2538,"description":2539},"Your Subscription","\u002Fbyodt-subscription\u002Fyour-subscription","08.byodt-subscription\u002F01.your-subscription","Create an account, subscribe by card, and find the values your deployment needs on the portal",{"title":2541,"path":2542,"stem":2543,"description":2544},"Moving a Deployment to a New Team","\u002Fbyodt-subscription\u002Fmoving-a-deployment-to-a-new-team","08.byodt-subscription\u002F02.moving-a-deployment-to-a-new-team","What to do with the deployment you already run once you buy a team edition: three ways forward, best first",1793748185439]