Every change in a project goes in the book.
| Time | Actor | Action | Target | Permission | Result |
|---|---|---|---|---|---|
just now Oct 19, 09:43:29 AM | Michael Okafor | Remote command succeeded: Flush DNS cache | vm:vm-1756693248-t6jc | vm.remote.exec | allowed |
just now Oct 19, 09:43:16 AM | Jana Weber | Enabled deletion protection for VM "web-prod-04" | vm:vm-1759312044-k3x9 | vm.edit.resources | allowed |
just now Oct 19, 09:43:03 AM | System | Lease expired — powered off VM "test-lab-08" | vm:vm-1759055183-m1uf | vm.power.hardstop | allowed |
just now Oct 19, 09:42:39 AM | Sven Lindqvist | Rebooted VM "web-stage-02" via API | vm:vm-1758116702-b4zs | vm.power.reboot | allowed |
1m ago Oct 19, 09:42:26 AM | Sofia Lindqvist | Renewed lease on "test-lab-11" by 14 days (now expires 2026-11-02) | vm:vm-1759920376-h7pe | lease.renew | allowed |
1m ago Oct 19, 09:42:13 AM | Michael Okafor | Deleted snapshot "before-upgrade" | vm:vm-1757480021-w5na | snapshot.delete | denied |
1m ago Oct 19, 09:41:49 AM | Sven Lindqvist | Created VM "test-lab-31" (2 vCPU · 4 GB · 60 GB) via API | vm:vm-1760611930-c2rt | vm.create | allowed |
1m ago Oct 19, 09:41:36 AM | System | Scheduled start at 07:00 — VM "build-agent-02" | vm:vm-1758904417-q8dm | vm.power.start | allowed |
2m ago Oct 19, 09:41:12 AM | Jana Weber | Created snapshot "pre-patch" | vm:vm-1759312044-k3x9 | snapshot.create | allowed |
Who changed what, on which VM, with which right — from a person, a script or the scheduler.
One line, six fields.
Enough to answer the question a year later.
- 01timestampFilter by time window or by day.
- 02actorThe person — or system, for the scheduler.
- 03actionA readable sentence, with names.
- 04targetThe VM, project, grant or rule touched.
- 05permissionThe right that was checked.
- 06resultOr denied — with the right that was missing.
6 built-in roles. 62 permissions.
Granted per project, to people or to groups.
| Permission key | ||||||
|---|---|---|---|---|---|---|
| vm.viewView owned VMs | yes | yes | yes | yes | yes | yes |
| vm.view.allView all VMs | yes | yes | yes | no | no | no |
| vm.createCreate VMs | yes | yes | yes | no | no | no |
| vm.cloneClone VMs | yes | yes | yes | no | no | no |
| vm.edit.resourcesEdit resources | yes | yes | yes | no | no | no |
| vm.owner.changeChange owner | yes | yes | yes | no | no | no |
| vm.power.startStart | yes | yes | yes | yes | no | no |
| vm.power.shutdownGraceful shutdown | yes | yes | yes | yes | no | no |
| vm.power.hardstopdangerousHard stop | yes | yes | yes | no | no | no |
| vm.power.rebootReboot | yes | yes | yes | yes | no | no |
| vm.power.suspendSuspend | yes | yes | yes | no | no | no |
| vm.power.resumeResume | yes | yes | yes | no | no | no |
| vm.consoleConsole (noVNC) | yes | yes | yes | yes | no | no |
| vm.migrateMigrate | yes | yes | no | no | no | no |
| vm.remote.execRun remote commands | yes | yes | no | no | no | no |
| vm.remote.exec.arbitrarydangerousRun arbitrary commands | yes | yes | no | no | no | no |
| vm.db.viewBrowse databases | yes | yes | yes | no | no | no |
| vm.db.querydangerousQuery databases | yes | yes | no | no | no | no |
| vm.deletedangerousDelete VMs | yes | yes | no | no | no | no |
role + allow − revoke
Start from a role, adjust the edges — a revoke always wins.
Direct role
Role assigned directly to this user for this project.
| Group | Source | Role | Extra | Revoked | Actions |
|---|---|---|---|---|---|
| app-team | AD | Service Desk | — | — |
Jana Weber is in app-team — both grants apply.
Effective permission matrix
Combined from direct grant and inherited group grants. Toggle to add an extra grant or revoke.
Virtual Machines
vm.view.all
See every VM in the project.
vm.create
Provision new virtual machines.
vm.power.hardstop
Forcibly power off a VM.
vm.power.suspend
Hibernate a VM to disk — its memory is written to storage and the host RAM is released.
vm.console
Open the remote console.
vm.remote.exec
Execute allow-listed preset scripts in the guest via the agent.
vm.delete
Permanently destroy a VM.
Snapshots
snapshot.restore
Revert a VM to a snapshot.
Leases & Scheduling
lease.renew
Extend a lease by a number of days.
Members & Access
audit.view
Read the activity / audit log.
Sign-in and API keys
With the account they already have.
No Verlocx passwords — access follows the directory.
- Active DirectoryBinds as the user · memberOf → portal groups
- Microsoft Entra IDOpenID Connect + PKCE · groups claim → portal groups
With a key that can only do less.
Scopes and projects narrow the owner's permissions — never add to them.
Authenticate REST calls with Authorization: Bearer hx_… against /api/v1. Keys can never do more than your own role allows.
| Name | Key | Status | Created | Expires | Last used | |
|---|---|---|---|---|---|---|
| ci-pipeline | hx_3f9a1c0b | Active | Aug 4, 2026 | Nov 2, 2026 | Oct 19, 2026 | |
| backup-report | hx_81d07e42 | Revoked | Mar 12, 2026 | never | Jun 30, 2026 |
Some VMs should be hard to lose.
A protected VM can't be destroyed — by anyone — until the flag is cleared.
web-prod-04 · Resources tab
Current configuration · web-prod-04
CPU
Memory
Disk
Boot & behaviour
Protection
VMs list · row menu
| Status | VM ID | Name | OS | Owner | IP | Protected | Actions |
|---|---|---|---|---|---|---|---|
| 204 | web-prod-04 | Windows Server 2022 | Jana Weber | 10.20.4.50 |
Protected: Delete is greyed out. Clear it under Edit resources.
web-prod-04 · Activity tab
| Time | Actor | Action | Target | Permission | Result |
|---|---|---|---|---|---|
| No activity for this VM. | |||||
09:47:20 you Requested a walkthrough of roles & audit