Access Diagnostics
Every request verified. Every decision explained.
The most common support question is: can this person reach this resource, and if not, why not. Access Diagnostics answers it by evaluating the real rules in order and showing each step in plain language. Simulate a change and watch the answer change, with nothing saved.
Try it
Ask the question the support desk gets every day
A sample organisation with people, devices, groups, rules and Trust Checks. Pick a person and a resource; the evaluation is the one the Control Center runs.
Try these questions
Not allowedMaya can't reach Grafana: no Access Rule allows it.
maya-mbamacOS · 100.64.8.15Not allowed
- This is what blocks accessNo Access Rule allows itNo enabled rule has a source group of maya-mba and a destination that includes Grafana.Access Rules
Sample organisation: people, devices, rules and Trust Checks from the Control Center's own example data.
How it answers
The real evaluation, step by step
- 1Who and whatPick the person, the resource, the protocol and the port. Diagnostics resolves the person's devices and the resource's network path.
- 2Checks in orderIdentity, groups, Trust Checks and Access Rules are evaluated in the order the platform applies them, and each step shows its verdict.
- 3The step that blocksA denial points at the exact step and says why: no rule grants it, a Trust Check fails, a device is not enrolled.
- 4What would change the answerDiagnostics proposes the smallest fix, such as adding the person to a group or enabling a draft rule, and lets you simulate it.
Simulation
Change nothing. Learn everything.
- Group membershipAdd the person to groups as if an administrator had, and see which resources open.
- Draft rulesSwitch on disabled rules that could grant the resource and watch the verdict change.
- Assume postureAssume the device passes every Trust Check to see what else would still block access.
- Nothing is savedA simulation is a question, not a change. The Control Center says so on every result.
Across the console
Explainability everywhere
Diagnostics is one part of a console that explains itself.
- What this doesEvery create dialog ends with a readout of the effect of what you are about to save.
- What saving doesSettings pages state the consequence of the change, and what is still needed before it takes effect.
- Type to confirmA change that re-addresses devices asks you to type its name before it runs.
- Unknown is never greenHealth is shown for measured components only. A component nobody has measured is marked unknown, not healthy.
Questions buyers ask
Does Access Diagnostics use the real rules?
Yes. It evaluates your rules, groups, devices and Trust Checks with the same logic the platform applies to a live request, so the answer is the answer.
Who can use it?
Administrators and auditors with the Access Control permission. Delegated administrators see the scope they administer.
Can support staff use it without changing anything?
Yes. Diagnostics reads policy and never writes it. Simulations are evaluated in memory and discarded.
Does it cover ZERA as well as the agent?
Yes. Both paths are decided by the same Access Rules, so a question about a Protected Service is answered the same way as a question about a device.