Is Lock a replacement for the existing identity system?

Identity is Lock’s first clause, not the whole decision. Lock reads identity alongside authority, policy, permission and operational state, and answers as one coherent layer.

What about emergency access?

Emergency break-glass is a Lock event with quorum approval, full audit and a hard expiry.

How does Lock handle service accounts?

The same way as people: reach is granted to a named actor, for a purpose, for a window, with scope narrower than the access path can technically allow, and a recorded purpose for each grant.

Where do decisions live for review?

Every outcome and its reasons are logged through Anchor on physically separate storage, and decision patterns are reviewed on a regular schedule.

FV-08 LockControl module · Protect the asset

Being on the network is not permission.

Lock restricts access to protected assets by defined identity, permission and policy. Being connected is not enough; only the people and systems you name can use or change the asset, and every use is recorded.

Book a Control demo See it in action

LockProtect the asset

Module: FV-08 Lock
Family: Protect the asset
The question it answers: Who may use or change this asset?
Based on: Identity, permission, policy
Records: Every use and change

What happens when

Everyone on the network could see it. So could the attacker.

Protected assets are often reachable by anyone already inside. That includes anyone who got inside with a stolen login.

MorningA contractor joins.
They are given network access for a project.
AfternoonThey can see the board records.
Nobody intended that. The records were simply reachable.
Weeks laterTheir login is stolen.
Whoever has it can reach the records too.

Network access is not a reason. Lock makes permission explicit.

See it in action

Four people, one asset. Switch between network access and Lock.

The same people and the same board records, handled two ways.

Network accessWith Lock

Anyone on the network can reach the board records.

Only the named owner, with the right permission, can reach them. The others are not refused one by one; they were never given a path.

Step by step

Step 1Name the asset
Agree what is protected and who owns it.
Step 2Name the people
Decide which identities may use or change it.
Step 3Set the policy
Agree conditions such as time, location or approval.
Step 4Record
Every use and change is recorded.

What Lock is

Access by name, not by location.

Lock ties access to who someone is and what they are allowed to do, not to where they happen to be connected.

Defined identities
Only named people and systems.
Permissions
What each identity may do, and no more.
Policy
Conditions that must also be true.

What it changes

Protected assets reachable only by the right people.

Lock does not replace your identity tools. It makes sure being connected is never the same as being allowed.

Fewer people. Named people.

Only named identities can reach the asset
Permissions match the role, not the network
Every use and change is recorded
Stolen logins reach less

Where it fits

Fracture, Isolate and Lock answer different questions.

Fracture and Isolate decide whether connections exist. Lock does a different job, and most Plans use more than one module.

Module	Fracture	Isolate	Lock
The question it answers	Must this connection be physically disconnected now?	Which zones should never share a path?	Who may use or change this protected asset?
Normal state	Connected, with a crossing ready to be disconnected	Zones held apart, crossings closed by default	Locked, available only to named identities
When it acts	When a connection becomes dangerous	By design, before anything goes wrong	Whenever an asset is used or changed
What it ends	An incident travelling along a live path	Trust that exists only because systems share a network	Access granted simply by being on the network
Typical Plans	CP-01, CP-02	CP-04, CP-05, CP-14	CP-12, CP-06, CP-20

Control Plans and Blueprints

Where Lock does the work.

Lock sits behind privileged access, assurance and multi-party Plans. Plans marked Proposed are awaiting technical approval.

Control PlansTwenty Plans, each solving one problem.All Control Plans
Control BlueprintsIndustry solutions that combine Plans.All Control Blueprints
FracturePhysically disconnect a connection.See Fracture
IsolateHold zones apart by design.See Isolate

Questions

What network and security teams ask.

Want to see it on real hardware? We will show you.

Book a Control demo

How is Lock different from Validate?

Validate checks a request before a change. Lock defines who may use or change a protected asset at all.

How is Lock different from Fracture and Isolate?

Fracture and Isolate decide whether connections exist. Lock decides who may use the asset at the end of a connection.

Does Lock replace our access management?

No. It uses your identity sources and applies them to the assets in scope.

Are refusals recorded?

Yes, along with every use and change.

Your next step

See a protected asset locked in front of you.

We will show who can reach one of your assets today, and who could with Lock.

Book a Control demo