1. Install the mature daemon and fixed AAA runtime service on the private platform host.
2. Select up to 100 unregistered devices and confirm each exact AAA source IP. Register selected disabled clients generates a distinct Broker key per device; it sends no router configuration.
3. Select registered clients, confirm Enable selected, then Prepare selected server configs. Review every masked difference and Apply the exact selected plans through the Automation Worker. Execution and errors are shown per device; 100% finished does not mean all succeeded. Verification diagnostics identify the failed stage without exposing secrets.
4. Prepare selected withdrawals restores only the owned server configuration. After verified withdrawal, disable clients and use Delete selected disabled clients to remove registrations and grants. Cancelling a pending plan is not withdrawal.
5. Grant an existing eligible user Read-only or Device administrator access on explicit clients. Web group permissions do not grant device access. Server configuration does not change authentication order or prove login.
6. Review authentication/policy and sanitized start-stop accounting events. Revoke denies subsequent authentication, but does not terminate existing SSH sessions.

Initial support is Nokia SSH/MD-CLI and local-password identities. OIDC/MWAN/MFA handoff is not a reusable device password; NETCONF/gRPC/other access and multi-vendor profiles are not enabled. Delete clients only after withdrawal and disablement.

Standard planning flow

1. 1
   Choose type

   Select the exact domain or service.

2. 2
   Select targets

   Use collected, available resources.

3. 3
   Review plan

   Check every target payload, rollback, verification, and hash.

4. 4
   Choose route

   Direct, approval, or MOP only when policy offers it.

5. 5
   Follow evidence

   Track all targets until verified or stopped.

1. Select a network element.
2. Choose Capture Config if you have inventory permission.
3. Wait for the new append-only snapshot.
4. Select exactly two rows and choose Compare.
5. Review additions, removals, source, size, collector, and checksum.
6. Use Trace usage to find Change Requests, automation baselines, backups, or restores that reference the snapshot.

1. Choose concurrency from 1 to 8.
2. Select Run Manual Sync.
3. Open the run detail.
4. Review readiness, inventory, config, and errors for every NE.
5. Resolve incomplete targets individually.

1. 1
   Read live users.

   Select enrolled devices in Credentials and read their current user/profile configuration and operational table. Evidence includes its collection time; passwords and hashes are never displayed.

2. 2
   Prepare a batch.

   Create, edit permissions, or delete a user. Choose existing device profiles. An empty password on edit preserves the old password. Admin and bound management identities are protected.

3. 3
   Review and apply.

   Inspect each masked difference, then apply the reviewed batch. Results are per device. Prepare undo restores the prior object through another reviewed plan.

Credentials shows current-batch progress, per-device stages and error codes. Prepare only reads and freezes a difference; users are created only after Review & Apply. Password validation errors appear inside the dialog. Protected management users are visible but disabled; edit/delete lists show how many selected devices contain the user and explicitly list the actual targets before submission.

Bulk plan controls. Task-row checkboxes are independent of the device picker. Use status filters or search by device/IP/user/error, then Select pending (up to 100 visible plans). Review selected inspects all exact masked differences; Cancel plans confirms and cancels unexecuted work, not existing device users or completed configuration. Expired plans cannot be applied: use Refresh prechecks, wait for Worker preparation, then review and apply the new differences. The batch's Refresh expired prechecks shortcut confirms all exact expired targets in that batch. Running, uncertain or locked tasks cannot be cancelled.

Waiting is not running. A batch with no queued/running tasks and pending plans is waiting for your review, not stuck in a Worker. Prechecks settled and device tasks settled are separate; the percentage includes failures and cancellations, not just success. The compact list scrolls inside the card; Details opens the masked difference and verification checks. AAA service, registration, clients, access grants and audit can be expanded only when needed.

Choose devices by role and search. AAA registration, clients, access grants, device-local users and Syslog configuration offer Device role, name/IP/role search and Reset filters. Select filtered chooses up to 100 matching eligible devices, not hidden devices. Changing filters removes hidden selections; widening them does not reselect devices. Counts show the selected and visible scope. Roles use saved inventory metadata, never name guesses. Task tables combine role, status and search. Access grants show the exact platform user, device permission and target list for review before Save; this does not configure devices or change platform permissions.

Network → Device Syslog shows live received logs with device, platform receipt-time and Syslog severity filters. Live refresh runs every 5 seconds; older pages pause it. Nokia maps Critical/Major/Minor/Warning to Syslog 1 Alert/2 Critical/3 Error/4 Warning; Cleared/Indeterminate map to 6 Info. See Nokia's official mapping. Device timestamps remain in the original message and may differ from the platform clock.

Settings → Device Syslog still controls the receiver, retention (1–3650 days), device selection and logging configure/withdraw. Opt-in automatic logging authorizes the Worker to configure existing and newly managed devices; disabling the receiver alone does not withdraw their logging objects. Configuration success and received-log evidence are separate checks. Unknown write outcomes stay locked until read-only reconciliation proves running and saved state; uncertain password changes require explicit recovery.

Backup history and exact versions

BOF export format. In Download, select MD-CLI for hierarchical BOF or Classic CLI for the unchanged native boot file, then click BOF beside the exact version. The ZIP download follows that format and also offers Both formats for full recovery protection. Configuration files retain their stored syntax. Download filenames include the captured device name, original backup date and time through seconds in UTC (Z), backup ID and BOF format. This is not the download time; existing stored packages are unchanged.

Backup history, Download, and Restore each open the same spacious version window with every retained file, collection time and timezone, size, line count, backup method, and availability state. Backup history adds the protected delete action; Download adds a per-file download action; Restore adds a per-file restore choice that opens the existing governed preflight. Use Load older backups for earlier versions. Batch restore also lets you choose a version separately for each device.

Click X beside a history file, review its name and time, then confirm or cancel. Confirmed deletion removes the local configuration file and manifest. Audit records and retained configuration snapshots remain. Files used by active or unresolved restores cannot be deleted. If file removal is incomplete, use X again to retry.

An interrupted backup has an expired worker lease. Close expired task ends that platform record without reconnecting to the device. Automatic recovery marks expired backup tasks failed instead of retrying them.

Configuration Recovery

Open the Configuration Recovery tab to compare the latest retained backup with newer stored running-configuration evidence. The page is read-only: refreshing it does not contact a device or start Sync, backup, or restore work.

Safe evidence means the normalized configurations match and persistence passes. Persistence risk means the running configuration matches but restart survival is not proven; it is not proof of lost configuration. Diff review means the stored configurations differ and must be inspected. Evidence needed requires a fresh read-only Sync, while No verified backup requires creating a backup.

Inspect diff reads two same-device snapshots already stored by the platform. If review confirms unwanted drift or loss, choose Restore preflight. The normal fresh capture, candidate validation, exact diff review, Platform Administrator approval, commit-confirmed, and post-verification gates still apply.

After Start preflight, you may close the dialog. A progress row remains directly below that device and refreshes from the durable task record every two seconds. It shows the overall percentage, current step, last update, and a stable error code if the worker stops. Preflight completion pauses at 50% until a Platform Administrator reviews the frozen diff; use Review preflight to continue. A progress bar reaching 100% always includes an explicit verified, no-change, failed, rejected, rolled-back, or unknown outcome.

If the device lost its managed accounts with the configuration, enable Managed accounts were lost with the device configuration and enter the device administrator credential. It is kept only in the encrypted Credential Broker for this governed restore and is deleted at the terminal result. It never bypasses the pinned SSH fingerprint or the restore approval.

After configuration verification, the same row automatically runs an exact-device Readiness, Collect State + Config, and Discovery synchronization. Progress shows 90% while queued and 95% while running. If the final evidence is incomplete, fix the displayed condition and choose Retry final Sync; the configuration is not written again. An SSH server that advertises no cipher requires console/OOB repair before remote recovery can continue.

Automatic backups

Select devices, choose New schedule from selection, then set Daily, Every N days, or Weekly, the local time, IANA timezone, source, and enabled or paused state. Editing or deleting a schedule never deletes its existing packages or audit history.

1. 1
   Create the draft.

   Select an approved template, target NE, and valid parameters. Review the frozen intent.

2. 2
   Run Pre-check.

   The platform captures fresh configuration, checks access and drift, and records current values for rollback.

3. 3
   Run Dry-run.

   Review the private-candidate diff. The candidate is discarded. An empty diff completes as a verified no-op.

4. 4
   Submit and approve.

   The approver reviews the exact hash and diff. Approval issues a one-use authorization with a limited lifetime.

5. 5
   Execute with another identity.

   The executor must differ from the approver. The worker reacquires evidence, matches the approved diff, commits, and runs post-check.

6. 6
   Close the lifecycle.

   Confirm verified or rolled back. Use a typed withdrawal for a standing resource. Resolve uncertain outcomes only with external evidence.

AI Assist and Provider configuration

AI Assist selects shared profiles. Provider configuration is managed in Governance → AI Configuration, outside this dialog.

After creation

1. Review the MOP detail and all target steps.
2. Collect the required signatures. The executor must differ from every applicable approver.
3. Select Proceed / Execute once. The MOP Worker dispatches native children in strict order.
4. Follow each child until verified. Any non-verified child stops later work.
5. Export Excel for operator review, Markdown when required, or HTML as execution evidence.
6. Use AI Review / Analysis only as advice. It cannot change frozen plans, hashes, approvals, or execution.
7. For a completed blueprint, create a new governed withdrawal or recovery MOP when removal is required.

Remove completed history from the operational list

1. A Platform Administrator selects one or more terminal runs, or chooses Clear completed history.
2. Review the warning and scope. Active workflows remain disabled and cannot be selected.
3. Enter an administrative reason of at least 8 characters.
4. Type the displayed phrase exactly: ARCHIVE N MOP RUNS for a selection or CLEAR TERMINAL MOP HISTORY for all terminal history.
5. Confirm once, then review the resulting audit event.

1. Open Governance → AI Configuration with ai.configure.
2. Choose Anthropic or OpenAI, or Add third-party and select its compatible API format.
3. Set name, public HTTPS Base URL, model, API key and Enabled for shared AI tools. Save configuration.
4. Use Test connection after saving. It sends a minimal prompt to the saved endpoint; it does not analyse network evidence.
5. Open an AI tool and select the exact saved profile. Saving or refreshing this page does not start inference.

Only enabled profiles with a saved key appear in AI tools. MOP planning permission permits use; configuration permission is separate. Existing profiles retain their IDs and broker-protected keys. Never put keys or sensitive operational data in a prompt. AI results remain advisory or drafts and cannot approve or execute changes.

My account workflow

1. Open Users & Access from the sidebar or choose Profile & access from the account menu.
2. Review your duty group, effective permissions, and any explicit removals.
3. For a local platform account, update your display name or optional email and choose Save profile.
4. Choose Change password to update your password. Use at least 7 characters with uppercase, lowercase, and a non-space special character.
5. A password change signs out every session; a profile-only update keeps this session active.
6. Ask a Platform Administrator to change your username, group, account status, or permission overrides.

Group defaults workflow

1. Open Group defaults and choose Edit defaults for Read-only, Planner, or Reviewer & executor. Platform administrator is immutable.
2. Keep platform.read; it is mandatory.
3. Add or remove only the listed delegatable operational permissions.
4. Treat ai.configure as sensitive and default-off. It may be granted to a group or one user when required.
5. Do not look for terminal.admin here. Administrator SSH is available only as a special per-user permission.
6. Review the final set before saving. Saving writes an audit event and revokes active sessions for current group members.

Administrator workflow

1. Create the user with username, display name, optional email, duty group, and temporary password.
2. Set individual permissions to Inherit, Add, or Remove only when a clear business need exists.
3. Use terminal.admin only for a named user who needs audited Administrator SSH. It can never be a group default.
4. Review the Effective permissions summary before saving.
5. Tell the user that group, status, permission, password reset, or password change revokes existing sessions.
6. Review the audit event after every access change.