Resource model
Understand ownership, stable identities, collectors, policies, observations, and execution.
Guard separates what an organization owns, what executors enforce, and what observations show. An asset can have several coverage paths with independent health.
These resources define ownership, selection, and execution:
| Resource | Identity and ownership | Relationship |
|---|---|---|
| Organization | org_acme; security and billing boundary | Owns every resource in this table |
| Asset | ast_web01; durable inventory record | Represents a service, device, or network target |
| Asset group | grp_pilot; organization selector | Selects assets for access and policy assignments |
| Endpoint | end_laptop01; device management record | References an asset and an agent identity |
| Protected service | svc_store01; traffic configuration | References a service asset and admitted edge route |
| Policy | pol_endpoint01; revisioned configuration | Published revisions assigned to assets or groups |
| Detection | det_001; observed security event | Can contribute to one or more incident investigations |
| Finding | fnd_001; assessment result | Tracks remediation independently of incident status |
| Incident | inc_001; investigation record | Collects evidence, actions, decisions, and owners |
| Action | act_001; response request | Records authorization and each executor's result |
| Operation | op_001; asynchronous work record | Tracks execution of a change or report job |
Names and tags can change without changing IDs. References use IDs rather than display names. An IP address is an observation, not a durable device identity. NAT, DHCP, and reinstalls can change associations; review identity conflicts under Assets → Identity review rather than merging solely by hostname.
Scope and permissions
Organization membership determines a role and allowed groups. The access model intersects those grants with API scopes. A policy assignment cannot expand the author's permitted target set. Cross-organization references are rejected even when names match.
Installation administrators operate deployment configuration; that role does not automatically grant access to organization evidence. Organization Owners manage membership and billing; response approval and sensitive-data access use separate grants.
Execution boundaries
The control plane accepts configuration and records intent. Agents enforce supported endpoint controls; gateways enforce network access; scanners execute authorized assessment jobs; the Solarius edge processes admitted protected traffic. External integrations acknowledge their own deliveries.
Policy publication is separate from adoption. A successful configuration update can coexist with offline targets. Operations record asynchronous results, while resource Coverage shows actual reporting health. A missing observation means unknown coverage, not zero threats.
Retirement and retained records
Use the feature's retirement workflow before deleting an asset. Active service routes, enrolled endpoints, assignments, and access applications block asset deletion. Removing an inventory row cannot remove an origin firewall rule or uninstall an agent. Historical detections keep their asset ID and last recorded name.
Retention and holds govern historical records after retirement. Incidents and findings remain addressable while retained; closing them does not remove their underlying evidence or undo protection.