IT asset management
The register is not a side product. Serial, hostname, and custodian are how the endpoint agent knows which screen to lock when a session is revoked.
The register is in the security path.
Most asset databases are reporting tools that drift because nothing breaks when they are wrong. This one is consulted at the moment of enforcement.
Hardware, licences, cloud subscriptions, certificates, and domains live in one workspace schema. Custom fields become searchable columns without a migration, so the attributes your organisation actually tracks do not end up in a free-text note field.
Custodianship covers the awkward cases honestly. A device can be held by a person or by a team, which is what shared workstations and shift equipment genuinely are. The endpoint agent understands both, so a shared machine binds any principal valid for that zone rather than pretending it has one owner.
Because the register is what binds a serial number to a principal, a wrong row has an immediate consequence rather than a quarterly one. That is uncomfortable, and it is exactly why the data stays accurate.
- Classes
- Hardware, licences, cloud, certificates, domains
- Identity
- Serial number, hostname, asset tag
- Custodian
- A named person or a named team
- Location
- Site, building, plant, store, down to portal and room
- Custom fields
- Typed, searchable, no schema migration
- Lifecycle
- Procure, deploy, retrieve, repair, dispose
- Audit
- Immutable event history per asset
- Isolation
- One schema per workspace
Lifecycle events are security events.
Every state change writes to the same audit surface that revocation uses, so the history of a device and the history of its access are one record.
| Event | What it records | Security consequence |
|---|---|---|
| Procure | Purchase, supplier, cost centre, warranty | Nothing yet. The device has no custodian |
| Deploy | Custodian, location, hostname, enrollment | Binds the serial to a principal for desktop sessions |
| Retrieve | Return reason, condition, new location | Device epoch increments. The old custodian loses the binding |
| Repair | Vendor, dates, replacement parts | Off-estate handling recorded, agent treated as stale |
| Report lost | Who reported it, when, last known location | Device epoch increments immediately. Unlock is refused |
| Dispose | Method, certificate of destruction | Enrollment tombstoned, attestation retired |
Depth where people actually shop for it.
Hardware and lifecycle
Requisitions with approval chains, deployment to a custodian, retrieval and redeployment, repair cycles, and disposal with attribution at every step.
Locations model the real hierarchy rather than a flat text field: sites, buildings, plants, stores, and regions form a tree that assets attach to, so a question about one facility is one filter.
Digital assets
Software licences with seat counts and renewal dates, cloud subscriptions with spend, TLS certificates with expiry, and domains with registrar detail.
The renewal calendar is the part most registers omit, and it is the part that causes outages. Expiry is a first-class field, not a note.
Details that matter in practice.
Binding
Serial number to asset record to assigned principal, checked at unlock.
Shared devices
Team custodianship is a real state, not a workaround.
Search
Custom fields are indexed columns, so filters stay fast as the estate grows.
On premise
The same product and the same schema, deployed as a single tenant.
Directory linked
Custodians are directory principals, so leavers surface automatically.
Standalone
The register is useful on its own, before any portal exists.
Related
Bring the door onto the same epoch as the laptop.
We will walk you through a live portal, a compiled policy pack, and a revocation that closes the turnstile and locks the screen while you watch.