When the engineer cannot log into the machine

A decision note for delivery and security owners. In a controlled estate the person who can diagnose a fault often cannot reach it, and the person who can reach it cannot diagnose it. This is about what the delivery plan has to settle before that happens.

The decision, in short

Decide, before the work is committed, how a fault on that machine will actually be investigated: who runs the commands, what those commands are allowed to do, and what comes back as evidence.

If the plan assumes the specialist will be given access, check that somebody intends to grant it. Where nobody does, an operator-mediated route has to be designed in and agreed, not improvised during the first incident at the worst possible hour.

Where this comes up

A delivery specialist is accountable for a system running inside an estate they cannot reach. Access is not being withheld to be difficult: the boundary exists because of the data behind it, because the estate belongs to somebody else, or because issuing an account to a supplier is a change nobody wants to sponsor.

So an operator becomes the hands. They can reach the machine and run what they are asked to run. What they cannot do is read the output the way the person who built the system reads it. The investigation then arrives in fragments - a screenshot, a pasted extract, a phrase remembered from the console - and every round trip costs a day.

What heliograph establishes

The heliograph toolkit was built for exactly this shape. It is free, open source under Apache 2.0, and there is nothing to buy.

  • A step is published on one side and runs on the far side, and the whole run comes back as a log with every line stamped in UTC - so a hang reads as a gap rather than as slow progress, and the log returns whether the run passed or failed
  • The station is plain text the operator can read before running it: bash 4 and git, or the Windows PowerShell already on the box, and nothing compiled unless the relay or a trusted set of signing keys is chosen
  • A step is read-only unless the operator started the station to allow more
  • Today it does not tunnel, proxy or hold a connection open to anything, which is a large part of why this class of tool is permitted at all where the boundary is enforced

See Heliograph

What this does not establish

  • Whether it is permitted here. Whether any tool may run against that machine is a decision for the people who own the boundary, made on their policy and not on a README
  • That the operator can be removed. Somebody on the far side still starts the station and still decides what a step is allowed to do
  • What is wrong. It carries a step out and a log back; reading the log is still engineering judgement, and the log only answers the question the step asked
  • Whether this is worth an engagement. That depends on what the system does and what it costs while it is down, and nothing in a log says either

Who usually owns this decision

Not the engineer who hit the wall. The decision sits with whoever is accountable for the delivery date and whoever owns the access boundary - usually a delivery director and a programme security owner, together.

One of them carries the milestone and the other carries the rule that access will not be granted. Only the two of them together can settle how investigation is going to happen, which is why this is worth putting in front of both before the plan is signed off rather than after.

The bounded work DBHQ would take on

Investigation or delivery inside an agreed estate and an agreed access model. The access model is part of the scope and is written down before anything starts: which environment, who the operator is, what a step may do, and where the logs are kept.

There is no product to license here - the toolkit is free and open source - so what is bought is the engineering and the accountability for the outcome, not the tool.

See how delivery runs

A machine your specialist cannot reach?

Describe the estate, the access boundary and the work it is blocking. DBHQ will establish whether the work fits and what access model it would need.

Bring me the problemBook a call

I reply within 24 hours

https://dbhq.uk/notes/heliograph-operator-access/ · dan@dbhq.uk