Policy settings

The console-wide rules every session and every grant is measured against. All of them live under Infrastructure → Policy, take effect as soon as you save, and need no redeploy.

On your own server a handful of these have an environment-variable twin (AUDIT_RETENTION_DAYS, INVITE_TTL_HOURS, NOTIFICATION_WEBHOOK_URL, RECORDING_CONSENT_REQUIRED, SESSION_TTL_HOURS). The variable only seeds the first value; whatever is set in Infrastructure → Policy wins afterwards. On Cloud there is nothing to set outside the page.

Session controls

Three limits bound the sign-in itself, independent of any grant:

Idle timeout: a session with no activity for this long is closed and the user signs in again.
Max session lifetime: the longest a sign-in can last however active it is.
Max concurrent sessions: how many places one account may be signed in at once. Reaching the cap refuses the next sign-in, which is why a vendor on two laptops can report being "locked out".

Maximum grant duration

When set, every grant must have an end date no further away than this, and a grant with an empty window can no longer be saved. It is the setting that turns "time-boxed vendor access" from a habit into a rule: nobody can hand out access that never expires, by mistake or on purpose.

Source-IP allowlist

A list of IPv4 and IPv6 networks in CIDR form. When it is not empty, a vendor reaching a published resource from an address outside the list is refused, on every request, live. The check uses the real client address as reported by the front proxy, so it cannot be spoofed by a client-supplied header.

The console itself is never gated by this list. A wrong entry can shut vendors out of resources, but it cannot lock an admin out of the page needed to fix it.

Recording mode, consent and retention

Session recording mode: Off disables recording everywhere; Per resource leaves the choice to each resource's Record sessions toggle; Required records every session regardless, for deployments where compliance leaves no room for a forgotten toggle.
Require recording consent: the vendor must accept a notice before a recorded session starts; the acceptance is written to the audit log.
Session recording retention, in days. The connector applies it to the files on its own disk; the console trims its index to match.
Keystroke logging: capture typed input in remote-desktop sessions alongside the screen, which is what makes command search possible.
Audit log retention, in days. Older rows are removed while the hash chain stays verifiable.

Where the recordings are stored, how to play them and the deletion flow are covered in session recording and live view.

Clipboard, file transfer and watermark defaults

These are the values a resource uses while its own setting says Inherit or Default.

Default clipboard policy: Allow, Block copy out, Block paste in, or Block both. Applied to resources set to Inherit.
Remote-desktop defaults: the session engine's settings, file transfer among them. Here Default means the engine's own default, and for file transfer that is off. If a vendor must be able to drop files onto a server, turn it on here or on that resource.
Screen watermark: whether isolated-browser and web sessions carry the vendor's e-mail and a live clock over the screen by default.
Default connector log level: the level a connector starts at when it has no override of its own; Debug turns on per-request logging for troubleshooting and is pushed live.

Notifications, invite lifetime and time zone

Notification webhook URL: an endpoint that receives resource down and recovered alerts as a simple JSON post; a Slack or Teams incoming webhook works as is. Optional, and no mail server is needed for it.
Invitation link lifetime: how long an invite link stays valid before the person must be invited again.
Require justification on access requests: a vendor asking for a resource must say why; the text travels with the request to the approver.
Display timezone: the organisation's default zone for every date shown and typed in the console and the vendor portal. Each user can override it under Preferences; when neither is set, the browser's zone is used.
Time-Stamp Authority URL: an RFC 3161 service (KamuSM, for example) that seals the audit chain head with a trusted timestamp. What that protects against is explained with the audit log.