Fleet Exec

Fleet Exec is fleet-level remote command orchestration: pick a batch of devices, dispatch by command template, and collect results and audit centrally.

Flow

1. Choose a command template (which constrains the executable command shape).
2. Select target devices or device groups.
3. The manager orchestrates dispatch; hosts execute and report back.
4. Review per-device results in the execution detail; everything is recorded in audit.

Evidence vs Decision

Hosts only gather evidence / run constrained commands; orchestration and decisions stay in the manager. This mirrors the open-source baseline's diagnostic invariants: the server is the sole source of truth, suggest-only by default, higher-risk actions need explicit confirmation.

Safety Constraints

• Executable commands are constrained by command templates and AI policies — nothing runs freely.
• The Fleet PEP always rejects free-form commands. The per-command owner exception on an owner's own device belongs only to interactive diagnosis and never expands Fleet authority.
• Every execution enters AI Audit for traceability.

Related

• Template definition: Command Templates.
• Policy control: AI Policies.
• Traceability: AI Audit.