One console. Every key, every approval, every record.

The Axowl console manages your Roost boxes. Each product has a tile with live counts, every sensitive action waits for passkey seals, and every refusal says why.

Request a demo Read the docs

Approvals

One inbox for everything that needs a person.

Releases, certificate issuance, key retirement, adding a backup box: each waits here until the right people seal it with their passkeys. The seal is bound to the exact content, so an approval cannot be reused for something else.

axowl.com/dashboard/acme/roost/approvals

AxowlacmeRoostM

Approvals

3pending

14approved this week

1refused

Request	Detail	Seals
Release 1.4.2 · code signing	Approve to sign build 842	1 of 2	Approve with passkey
Issue certificate · api.acme.example	CA key · 2 of 3 security officers	2 of 3	Approve with passkey
Share key piece with backup box	ROOST-26-0003 joins the domain	0 of 3	Approve with passkey
Retire key version v1	data-key · 0 records still on v1	Done	Approved

Approvals inbox: every sensitive action waits for passkey seals.

Keys

Purpose templates, not attribute checklists.

A key is created with one word, its purpose. The template sets what the key may do and fixes what it may never do: a signing key cannot decrypt, a private key cannot be exported, and there is no switch to change that. Each key shows its versions, its birth record and its policy.

axowl.com/dashboard/acme/roost/keys

AxowlacmeRoostM

Keys

27keys

3rotating

0exportable

Name	Purpose	Version	Quorum	Last used
release-signing	code-signing	v3 active	2 of 3	2 min ago
StatusArmed PolicyApproval required Born inROOST-26-0001 ExportNever
data-key-eu	data-key	v2 active · v1 decrypt-only	2 of 3	10 s ago
tls-www	tls	v1 active	2 of 3	1 s ago
ca-intermediate	ca	v1 active	2 of 3	3 days ago

Keys: purpose templates, versions and a status card for each key.

Partitions

Dev and prod never mix.

A partition is a separate key space with its own wrap key. A prod key cannot be copied into dev. A partition for a test run has a lifetime and disappears with its keys when the run ends.

axowl.com/dashboard/acme/roost/partitions

AxowlacmeRoostM

Partitions

6partitions

2temporary (CI)

27keys

Name	Env	Keys	Lifetime	Approvers
prod	prod	14	—	security-officers 2 of 3
payments	prod	5	—	security-officers 2 of 3
dev	dev	6	—	owner 1
ci-build-842	dev	1	expires in 21 min	—
ci-build-843	dev	1	expires in 29 min	—

Partitions: dev and prod never mix, and CI partitions expire on their own.

Policies

Who may do what, and when a person must approve.

Rules are read in order and name the keys, the caller, the action and the effect: permit, deny, audit, a limit, or approval required. A new rule set runs in record-only mode first, so nothing breaks while you check the records.

axowl.com/dashboard/acme/roost/policies

AxowlacmeRoostM

Policy rules Record only

#	Keys	Who	Action	Effect
1	release-signing	ci-runner	sign	Require approval
2	data-key-*	orders-api	unwrap	Permit · audit
3	data-key-*	agent: ledger-bot	unwrap	Permit · limit 200/h
4	ca-*	anyone except Security officers	any	Deny · audit
5	*	*	export	Deny

Policy rules: who may do what, with approval, limits and exclusions. Record-only mode tries a rule before enforcing it.

Access

People, applications and AI agents, each with their own identity.

Applications authenticate with a workload identity or mutual TLS and receive short-lived credentials. An AI agent has its own identity, limits and an approval threshold, and can be cut off with one switch.

axowl.com/dashboard/acme/roost/access

AxowlacmeRoostM

Access Identities · Agents

Identity	Kind	Partition	Authenticates with	Credential	Last used
orders-api	Application	prod	Workload identity	15 min, renews	3 s ago
ci-runner	Application	dev	Mutual TLS	15 min, renews	2 min ago
ledger-bot	AI agent · for team:finance	prod	Own identity	10 min, renews	40 s ago
Keysdata-key-eu Actionsunwrap Limit200 / h · 173 used Approve above1,000
J. Park	Security officer	prod · payments	Passkey + site key	—	09:12
M. Lee	Auditor	all (read)	Passkey	—	yesterday

Access: people, applications and AI agents, each with its own identity and limits.

Devices

A signed status report every minute.

Each box reports its voters, tamper state, temperatures, power, mesh, time and firmware, signed with its own key. Pairs, enrollment, identity, firmware rollouts, maintenance and air-gapped sites live here.

axowl.com/dashboard/acme/roost/devices

AxowlacmeRoostM

Devices

2boxes

1pair

0alerts

Serial	Site	Voters	Tamper	Firmware	Status
ROOST-26-0001	Seoul HQ, vault floor	3/3	Armed	1.1.0 (B)	Green
ROOST-26-0002	Busan DR site	3/3	Armed	1.1.0 (B)	Green

Chip temp46–50 °C

Mesh100.1 %

TimeNTS · 8 ms

AttestationMatch

Devices: a signed status report every minute, with the pair and the tamper state.

Diagnostics

One command, from the network to the box.

roost check walks six steps and stops at the first problem with what to fix. It produces an evidence bundle for support, never containing a secret, and measures signing and unwrap throughput against the real quorum.

axowl.com/dashboard/acme/roost/diagnostics

AxowlacmeRoostM

Diagnostics · roost check from orders-api host

#	Step	Result
1	Network	roost-a.example:443 reachable	ok
2	Trust	box identity ROOST-26-0001 verified · attestation match	ok
3	Partition	prod visible	ok
4	Login	acme/orders-api · credential renews in 12 min	ok
5	Box	3/3 voters · armed · NTS 8 ms	ok
6	Sign	test seal on prod	ok

Evidence bundle Measure (bench)

Diagnostics: one command walks from the network to the box and stops at the first problem.

Alerts

Thresholds per item, per box.

Temperature, voltage, batteries, mesh resistance, quorum, fans, power, time sync and signing rate each have a yellow and a red band. Red pages at once, yellow after five minutes, and a return to normal sends one recovery notice.

axowl.com/dashboard/acme/roost/alerts

AxowlacmeRoostM

Alerts

0red

1yellow

2boxes green

Item	Yellow	Red	ROOST-26-0001	ROOST-26-0002
Chip temperature	≥ 80 °C	≥ 90 °C	46–50 °C	45–49 °C
Mesh resistance	± 1 %	± 1.5 %	100.1 %	99.9 %
Voter quorum	2 of 3	< 2	3 of 3	3 of 3
Time sync	> 100 ms	> 500 ms	8 ms	11 ms
Battery 2	< 2.7 V	< 2.5 V	3.61 V	2.68 V
Signs per minute	> 3× baseline	> 10× baseline	41	38

Recipients: owner · roost admins · soc@acme.example · SNMPv3 nms.acme.example

Alerts: thresholds per item and box; red pages at once, yellow after five minutes.

Records

A sealed chain the auditor verifies.

Every signature, refusal, approval and tamper event is a sealed record with who, what, when and a correlation id. Refusals carry their reason. Records are exported over syslog and SNMPv3 with the audit record id on every line.

axowl.com/dashboard/acme/roost/records

AxowlacmeRoostM

Records

Time	Event	Detail	Chain
09:12:41	`roost.sign.completed`	release-signing · build 842 · approved by J. Park	Sealed · verified
09:12:40	`roost.approval.sealed`	Release 1.4.2 · passkey seal 2 of 2	Sealed · verified
08:55:03	`roost.sign.refused`	release-signing · no approval for build 841	Sealed · verified
08:00:00	`roost.attestation.recorded`	ROOST-26-0001 · measurements match	Sealed · verified

Export: syslog TLS to siem.acme.example · SNMPv3 traps · Evidence report (signed)

Records: a sealed chain the auditor verifies, with a reason on every refusal.

Evidence reports

Produced and signed by the appliance.

Event exports, key attribute reports and access review matrices come out of the box signed with its identity key, so an auditor verifies the report itself instead of trusting a screenshot.

axowl.com/dashboard/acme/roost/records/reports

AxowlacmeRoostM

Evidence reports

Report	Scope	Period	Signed by
Event export	all partitions	2026 Q3	ROOST-26-0001 identity key	Download
Key attribute report	prod · payments	as of today	ROOST-26-0001 identity key	Download
Access review matrix	all	as of today	ROOST-26-0001 identity key	Download
Chain verification	all	last 90 days	verified by M. Lee (auditor)	0 gaps

Each report is produced by the appliance and signed; auditors verify the signature with the published identity key.

Evidence reports: produced and signed by the appliance, ready for an audit.

Cloud keys

The cloud asks Roost every time.

Roost is an external key store for cloud key services and the source for keys you bring to a cloud. One list shows every cloud key and the Roost key behind it. Cut the connection and the data stays locked.

axowl.com/dashboard/acme/roost/cloud-keys

AxowlacmeRoostM

Cloud keys

3clouds connected

11keys

2rotating this month

Cloud	Key	Status	Purpose	Protection	Next rotation	Roost key
AWS ap-northeast-2	orders-db	Available	Encrypt · Decrypt	External key store	12 Dec	data-key-eu v2
Google asia-northeast3	bq-cmek	Available	Encrypt · Decrypt	External key manager	12 Dec	data-key-eu v2
Azure koreacentral	vault-byok	Available	Wrap · Unwrap	Bring your own key	1 Mar	kek-azure v1

Add key 1 Select origin → 2 Source key → 3 Cloud key → 4 Review · passkey approval

Cloud keys: the cloud asks Roost every time; cut the connection and the data stays locked.

CI/CD

Every run gets a partition that expires.

The simulator runs in your pipeline with the same policy code as the appliance. Test keys are named after the run and vanish with it, and a release without approval is refused and recorded.

axowl.com/dashboard/acme/roost/ci

AxowlacmeRoostM

CI/CD

2runs active

184runs this week

0keys left behind

Run	Partition	Keys	Started	Expires	Result
build-843	ci-build-843	ci-build-843-sign	09:31	10:01	Running
build-842	ci-build-842	ci-build-842-sign	09:12	09:42	Passed · released
build-841	ci-build-841	ci-build-841-sign	08:50	expired	Refused · no approval

Simulator: ghcr.io/axowl/roost-sim:1 · same policy code as ROOST-26-0001 (1.1.0)

CI/CD: every run gets a partition that expires, and a release without approval is refused.

See Roost refuse an unapproved signature.

A 30-minute live demo with our engineers.

Request a demo