Practical operating guidance for L3 engineers

How this manual is structured

Each page covers one capability area with production-oriented workflows, reference tables, field behavior, and troubleshooting guidance. Pages are organized from platform setup through day-two operations and exception handling.

• Foundations — Identity, tenant structure, and account setup. Use these pages before rollout or when validating access and scope behavior.
• Core Operations — Host control, monitoring, patching, workflows, and elevated access. These pages cover the daily execution loop and its common failure modes.
• Service Management — Incident, escalation, change, and request workflows for teams that need governed service operations.
• Security & Compliance — Compliance checks, remediation, vulnerability handling, anomaly detection, and service dependency context.
• Discovery & Network — Network discovery and device monitoring for infrastructure that cannot or should not run an agent.
• Administration — Active Directory, agent lifecycle operations, evidence capture, and platform integration points.

Quick start guide

Use this sequence when validating a new environment or establishing your first known-good operating path.

1. Validate identity and scope first. Confirm account, organization, MFA, and role context before touching operational features. See IDP & Tenant Management and Accounts, Orgs & Locations.
2. Bring hosts online and verify telemetry. Deploy agents or discovery probes, then confirm heartbeat, inventory, and host placement are correct before enabling automation. See Host Management and Agentless Discovery.
3. Test execution on a safe target. Run a diagnostic or controlled workflow to validate job dispatch, permissions, and result capture. See Workflows & Jobs.
4. Establish your guardrails. Review alerting, maintenance controls, patch policy, and access rules before broad rollout. See Monitoring & Alerts, Patch Management, and PAM & Credential Vault.
5. Confirm evidence and exception paths. Validate audit records, remediation outcomes, and how unresolved issues escalate. See Audit & Webhooks Software & Licenses, Remediation & Runbooks, and SLA & ITIL Operations.

Permission model

Cadres uses role-based access control. Every state-changing UI action and API operation is gated by permission, scope, and assignment resolution. L3 engineers should understand this model before troubleshooting “missing” actions or access failures.

How it works

• Roles are collections of permission keys. Custom roles can be created from scratch or cloned from built-in templates (Helpdesk Technician, Read-Only Auditor, etc.).
• Scope determines reach. Account-scoped roles grant access across all organizations. Org-scoped roles restrict access to a single organization.
• Assignments link a role to a user or group. Assignments can have expiration dates for time-limited access (e.g. contractor engagements). Expired assignments are automatically deactivated.
• Additive resolution means all assigned roles are merged. If any role grants a permission, the user has it. There is no "deny" — remove the role to revoke access.
• Group inheritance — users inherit permissions from all groups they belong to. Group assignments are resolved at request time alongside direct assignments.

Permission domains

Platform operations flow

The five-phase operating loop supported by Cadres, from asset onboarding through controlled execution, validation, and reporting.

Module status

All 24 manual pages are available. Each page is intended to function as an L3 reference for setup, execution flow, validation evidence, and troubleshooting.