The PAM agent fleet

Once you have enrolled a host with the PAM agent (see Enrolling the PAM agent on a host — that article covers minting the install token and does not repeat here), the fleet view is where you see what actually happened next: which hosts redeemed their token, whether they are still checking in, and what work is queued for or running on each one. Find it on Privileged → Clusters & agents (/pam/wave3), the PAM agents panel.

The fleet table

Every enrolled host appears with its hostname, platform, the agent version it is running, its status and when it last checked in.

A host running in outbound connector mode (see below) appears in this same table exactly like any other agent. There is no separate flag or badge for it — connector mode rides the same per-agent credential every other PAM agent capability uses, so from the fleet view's perspective it is not a different kind of agent, just one that happens to be reaching Qorionix outbound instead of accepting an inbound dial.

Checking an agent's tasks

The Tasks action on a row opens a modal listing that agent's recent tasks — their kind, status and expiry — along with a count of how many are pending or dispatched right now. Today's task kinds are rotate_local_password (an actual local-account rotation the agent has verified or failed) and update_usage (queued after a credential rotation for a dependent usage bound to this agent).

Revoking an agent

Revoke immediately stops the host from authenticating to Qorionix. Any time-boxed elevation the agent currently holds is withdrawn on the Qorionix side right away; on the host itself, the lease that grants that elevation is written to local disk precisely so it still expires on schedule even if the host can no longer reach Qorionix to be told to remove it — see Enrolling the PAM agent on a host for why that lease exists at all.

Outbound connector mode, for a host with no inbound path

A PAM agent normally accepts a direct inbound connection when Qorionix needs to relay a privileged session or a dial to it. Some hosts — behind NAT, behind a firewall with no inbound rule, in a network you do not want to open a hole in — cannot accept that inbound connection at all. Outbound connector mode is the alternative: the agent instead long-polls out to Qorionix asking for pending dial requests, and once one arrives, relays the session data over that same outbound connection. It is the same shape as a reverse-proxy or tunnel client — the kind of thing a WebSocket or a CONNECT tunnel does — rather than a VPN or a firewall change.

This is enabled entirely on the agent's own side: set the environment variable QX_PAM_CONNECTOR_MODE=1 in the PAM agent's own config or process environment on the host, and its connector loop starts running. There is no console toggle for this today — it is purely an agent-side setting, not a switch you flip from the fleet view or anywhere else in the console. If a host needs connector mode, that is a decision made when you deploy or configure that specific agent, not from Privileged → Clusters & agents.

What to do next

1. Enrol a host first if you have not already — see Enrolling the PAM agent on a host — then come back here to confirm it checked in.
2. If a host sits behind a firewall or NAT with no inbound path, set QX_PAM_CONNECTOR_MODE=1 when you deploy its agent rather than trying to open an inbound rule for it.
3. Revoke an agent the same day you decommission its host — a host that is gone but still Enrolled is one more credential lying around unnecessarily.