Who can reach which computers
Remote control and operator actions are governed through portal permissions, optional operator scope bindings, and protected groups that can block remote or command dispatch without the required role.
Security
Know who did what on every computer.
In plain terms: people only reach the computers they are allowed to reach, important work waits for approval, and an audit trail records who requested, approved, and did what, and the result. Business can run in your own Azure subscription. Technical details: scoped operator access, human-in-the-loop approvals, Governance controls for autonomy and self-elevate, and deployment into your own Azure subscription with Bicep, with credentials, telemetry, and keys kept in your tenant.
Example product viewFlowRMM / Remote ConsoleFlowRMM / Remote Console
Available now
What you can do today.
Approvals for important work
Human-in-the-loop (HITL) means a person reviews before it runs. Restricted commands land on the Actions queue for Approve & run or Reject. Agents and humans share one action plane, so MCP-requested work gets the same review surface.
A second reviewer by default
Four-eyes means a different person reviews the request, and it is the default: the requester cannot approve their own action. On Governance, you can allow HITL self-elevate only for selected client environments (sites inherit the parent client; Unassigned is its own environment).
Governance in the portal
Where human-in-the-loop is configured.
Governance is the control surface for action autonomy, HITL self-elevate, tenant policy (interpreters, timeouts, output retention), and operator scope, not a claim that every future RMM compliance module is done.
Public sector & government
Built for the controls government buyers expect.
Federal, state, local, tribal, and education teams run under different frameworks and different oversight bodies. FlowRMM is architected around the controls those programs care about: scoped access, human approval for consequential work, and attributable audit history: and we align the specifics to your authority to operate during the engagement.
Engagement model
Briefing first, then a scoped review of your framework, data sensitivity, and procurement path. We work to the assurance level your program requires.
In the product today
A credible control foundation.
- Tenant-, role-, and scope-aware operator access
- Human approval and four-eyes controls for consequential work
- Protected environments, encrypted credentials, and signed releases
- Attributable session, control, action, and audit history
Federal
NIST-aligned by design.
Our architecture follows the NIST-aligned control families federal programs are assessed against: defined boundaries, least-privilege operator access, evidence of every consequential action, and continuous reporting. We scope the authorization path with each federal partner.
Review FedRAMP 2026State, local & education
Ready for SLED oversight.
State, local, tribal, and education environments answer to a mix of GovRAMP, statewide policy, and sector rules like CJIS or HIPAA. The same boundary, evidence, and monitoring work supports whichever governing body reviews your program.
Review the GovRAMP programBring the requirement
Request a public-sector briefing.
Tell us your environment, data sensitivity, procurement framework, and the body that governs your IT program. We’ll walk your team through the controls, the audit trail, and how we meet the assurance level you’re held to.
Planned
Planned, not available yet.
Program-specific attestations
Framework mappings and formal attestations are handled per engagement, scoped to the oversight body your program answers to.
Absolute security guarantees
No software can eliminate risk; teams should evaluate controls against their own requirements.
Broader compliance packaging
Fleet-wide standards scorecards and deeper agentic policy libraries are still hardening, beyond the HITL and autonomy controls shown above.
Guides