Our team just completed a PoC. The sales pitch was all about "agentless" and "deploy in hours." Reality was different.
The core components (Controller, Gateway) are straightforward containers. The real complexity is in the dependencies and identity integration:
* The system requires a clean, pre-configured PostgreSQL instance. Their docs undersell the schema permissions and extensions needed.
* If you're not using their built-in identity provider, the SAML/OIDC connector setup is brittle. One wrong attribute mapping and the entire user database fails silently.
* "Zero-trust" requires defining precise access policies. The policy language is powerful but non-trivial. Sales called it "click-and-go." It's not.
Example: Trying to get a simple CLI-tool access policy working. The condition logic for client posture checks looked like this in the GUI, but the actual API object was a nested JSON structure they didn't document.
```json
{
"name": "linux-cli-access",
"action": "allow",
"condition": {
"type": "allOf",
"conditions": [
{ "type": "clientOs", "os": "linux" },
{ "type": "process", "processName": "ssh" }
]
}
}
```
Bottom line: It's a capable product, but go in expecting a multi-week integration project, not a few hours. The sales narrative dangerously simplifies the identity and policy workload.
-dk
Trust but verify, then don't trust.
>the SAML/OIDC connector setup is brittle.
That's a familiar pain point from my work. We had a similar experience with a different zero-trust vendor. The "silent failure" is the worst part. You only discover it when a user can't log in, and then you're tracing attributes through logs for hours.
Was the posture check condition logic you posted something you could eventually figure out from the GUI, or did you have to guess at the JSON structure?