01 / ESTATE
Know what runs.
Inventory, health and change history across AWS, Google Cloud and Azure.
Explore EstateINDEPENDENT CLOUD OPERATIONS / VOL. 01HOST IT. OWN IT. UNDERSTAND IT.THE CLOUD OPERATIONS REVIEW • 2026
The big picture, without the big promises
Know what runs.
Know what it costs.
Inventory, spend and approved changes. Across your clouds, under your roof.
A clear view of what you own, who owns it, and what changed — without shipping control of your infrastructure elsewhere.
THE DAILY LEDGERSAMPLE ESTATE / 14:20
At a glance, not in six tabs.
ITEMS NEEDING ATTENTION3 failures · 2 approvals pending · 1 budget warning
06
Keep the keys. Get the answers.
SUPPORTED ESTATE SOURCESawsGoogle CloudMicrosoft AzureDEPLOY VIA DOCKER OR KUBERNETES
01 / INVENTORY
Know what exists.
Resources, owners, health and history across AWS, Google Cloud and Azure.
02 / MONEY
Follow the spend.
Costs by account and team, budgets, anomalies and forecasts where supported.
03 / CHANGE
Requests awaiting review02
Latest read14:20
Where changes runYour network
THE PRODUCT / FOUR PERSPECTIVES
Cloud operations,
in context.
Start with the part that matters to your team. Bring the estate, its costs and the changes you approve into one place.
02 / SPEND
Understand the bill.
Costs by team for AWS, Google Cloud and Azure; budgets, anomalies and forecasts for AWS and Google Cloud.
Explore Spend03 / PROVISIONING
Build with approval.
Templates, approvals and an agent that runs inside your network.
Explore Provisioning04 / PLATFORM
Bring it together.
A shared dashboard, access controls and resource ownership, hosted by you.
Explore PlatformYOUR INFRASTRUCTURE / YOUR DATA
Keep the keys.
Get the answers.
Run CloudPanorama with Docker Compose or Kubernetes. Read-only cloud access powers inventory; your agent runs approved changes using your credentials.
An offline licence needs no activation service. Your data stays intact when a licence expires.
Deployment and securityCLOUD COVERAGE / BY MODULE
| Module | AWS | Google Cloud | Azure |
|---|---|---|---|
| Estate | Yes | Yes | Yes |
| Spend | Yes | Yes | Yes |
| Provisioning | Yes | Yes | Yes |
Each module works with the services and billing sources it supports.
Explore documentationCAPABILITIES / BY MODULE
What the build does today.
The capability matrix, by module, with the same three words the documentation uses: available now is implemented and test-backed in the build, in development has a live verification or a dependency still open, planned has no date. This section is generated from the matrix, which the build's own tests hold to what runs.
Estate
- Inventory, derived health and the permanent status history available now
- The Dashboard: what needs someone now, ranked, each item linked to the page that explains it, then the estate by cloud and category, collection, spend against forecast, provisioning, recent changes and the hottest resources — the first page after sign-in available now
- Alerts, Slack and webhook notifications, and a public status page without identifiers — the front door for a visitor with no session available now
- Microsoft Teams, PagerDuty and email channels, each tested against a stand-in, email also against a real mail server; delivery to a live PagerDuty service and through a live mail relay is proven by the operator, with a step in the operator's manual available now
- Acknowledgeable alerts: a member acknowledges with a required note; the alert leaves the list until the resource changes again, and the acknowledgement is on the timeline available now
- Tag-defined application groups and declared apps, and freshness by each module's cadence available now
- Configuration diffs between snapshots on every resource's page, sensitive fields suppressed available now
- The change feed: configuration diffs, status transitions, acknowledgements, provisioning outcomes, cost anomalies and budget thresholds in one timeline per resource, account, app and team, ordered by the event's own time, with markers the customer's own systems post under a marker credential available now
- Ownership: one resolver deciding every resource's owning team from overrides, provenance, tags, the account and its relationships, with confidence and evidence, on every page that names an owner available now
- Impact and the investigator: one change and what moved around it — status, performance and settled cost on the resource and its neighbours — and, for a symptom, the changes before it ranked by time, distance and kind, each a candidate and never called a cause available now
- Tag policy: the tag keys a resource must carry and the values each admits, who complies with the money beside each answer, and at creation the agent stamps the team key, a request the policy cannot satisfy refused before it exists available now
- Findings: what needs fixing, grouped and prioritised, each priority showing its parts and its evidence available now
- Change alerts: a subscription to configuration changes that match a small predicate, judged as each read arrives, for a team or a declared app available now
- Relationships: a resource's neighbours — what contains it, what runs on it, what fronts and guards it, what provisioned it, the apps it belongs to, the team that owns it — each with evidence and confidence, drawn on its page available now
- Performance: latency, errors and saturation from CloudWatch with statistics, interactive charts and topology diagrams; EKS in depth, from the control plane to each pod available now
- Performance in depth: maxima, p95 and p99, a 30-day window read from an hourly rollup, and the hottest resources per signal with their pressure and a sparkline available now
- Performance for Google Cloud projects, from Cloud Monitoring: Compute Engine instances, Cloud SQL instances, Cloud Storage buckets, Application Load Balancers' forwarding rules, Cloud Run services, Pub/Sub topics and subscriptions, with the same statistics, windows and charts available now
- Performance for Azure subscriptions, from Azure Monitor: virtual machines, PostgreSQL flexible servers, SQL databases, storage accounts, App Service apps and AKS clusters, with the same statistics, windows and charts available now
- The inventory read every ten minutes, and the EC2 instances that start and stop between two reads recorded from EC2's own state-change events, with each run's start, end and lifetime in Changes available now
- Who made a configuration change: the CloudTrail events that may be it — principal, call and time, each a candidate and none chosen — on the change in Changes and in the investigator's evidence, for an AWS account whose administrator turns CloudTrail attribution on, within CloudTrail's 90 days available now
- Accounts: every connected AWS account, Google Cloud project and Azure subscription as an overview — what it holds by status and region, the state of its collection, the worst and stalest collector and when it was last read successfully — for any signed-in member available now
- Google Cloud projects: Compute Engine instances, GKE clusters, Cloud SQL instances, Cloud Storage buckets, VPC networks and subnets, Cloud Run services, Pub/Sub topics and subscriptions, BigQuery datasets, service accounts, Firebase apps and Cloud Functions, read through workload identity federation with a metadata-only custom role, every request field-masked available now
- Cloud Functions read from the Functions API's masked listing: every function under its own name whether or not it has run, with its state and labels, gone when the listing stops naming it available now
- Azure subscriptions: virtual machines, AKS clusters, SQL databases, PostgreSQL flexible servers, storage accounts, virtual networks and App Service apps, read by an app with no secret through federation and a custom role with no data action, connected from Admin → Accounts; every collector, and the role's refusal of content reads, verified against a live test subscription available now
Spend
- Cost Explorer ingestion with a 12-month backfill; Cost & Usage Report ingestion and amortization available now
- Tag allocation rules, inventory exceptions, anomalies, team budgets and Trusted Advisor recommendations available now
- Kubernetes attribution by the pods and nodes last seen, a current-placement approximation stated beside the figures available now
- Month-end forecasts with their range and measured error, on the tenant, team and account pages available now
- Reconciliation: a month's total from the places that must agree, per currency, with coverage and charge type beside it in development
- Cost change explanation: what moved between two periods, the movers summing to the difference, the changes in the same window beside them and never called causes available now
- Savings verification: a recommendation's saving split into usage and rate from the report's own quantities available now
- Showback out of the product: a page's table as CSV and a weekly digest per team by email in development
- Azure spend: a subscription's Cost Management export — FOCUS, or the ActualCost and AmortizedCost pair — read daily from its one storage container, as the subscription's reader, into the same cost tables, each export configured on Spend's Settings page with its last read available now
- Google Cloud billing: a billing account's detailed usage cost export in BigQuery, read daily by the project holding it into the same cost tables, under the same authority rule, with labels attributed as tags, each cloud in its own currencies on the overview; Google's figures are its cost before credits, or after committed-use credits alone, and the Overview says which; its figures are in the same anomalies, team budgets and month-end forecasts as AWS's available now
Provisioning
- Versioned templates, typed inputs, approvals, provenance tags, drift detection and scrubbed execution logs available now
- The customer-run agent: a broker that holds the token and a worker that runs OpenTofu under another user available now
- An OpenTofu apply against a live AWS account: the test estate brought up and torn down through the product's own templates available now
- The library: built-in OpenTofu templates for the AWS types the inventory reads, checked by hash in the agent, enabled for the organisation, cloned to edit, with a notice when a newer release arrives available now
- Each library release runs the small Blueprint — a network, a database and a service — live in a test account, from request to destroy available now
- A role per template on AWS: with the setting on, each request runs as its template's own role, granted only that template's documented policy and the state bucket; a missing role fails the request, never falling back to the agent's identity available now
- The catalog: category, then type, then template, with the accounts whose agent can run each available now
- Blueprints: several templates requested as one run across slots of accounts, one approval bound to the run's expressions, each step a request, resume after a failure and destroy in reverse available now
- Import: a live resource recorded under a template version that declares its type and a team, with its provenance, its owner and its history; nothing is written to the cloud, and drift is not computed until it is fully managed available now
- The agent on Google Cloud: an agent token for a project, Google provenance labels and state in a Cloud Storage bucket available now
- An agent installed in one step for an AWS account the platform already reads, through a CloudFormation quick-create link available now
- Making an import fully managed: an import-only apply into the agent's state, then a separately approved retag, and release from state available now
- Import of a resource no template in the catalog declares, on AWS and Google Cloud: the account's agent generates its template, kept as a private version outside the catalog, and runs it as that resource type's own runner available now
- Google Cloud templates in the library: storage, messaging, networking, identity, compute and clusters, serverless and databases available now
- Azure templates in the library — a private storage account and one for archives, a virtual network with private subnets and one behind a NAT gateway, a private Linux virtual machine and a Spot one, a function app for background work and one for HTTPS callers in named address ranges, a PostgreSQL flexible server for development and a highly available one, a serverless SQL database for development and a zone-redundant one, a private AKS cluster and one answering named networks — each in an existing resource group, each run as its own managed identity with a token of its own, holding only its template's actions, in the subscription the request is for, with OpenTofu state in a storage container of the customer's; each run live through the product on a test subscription available now
- Import's generated template for every Azure type Estate collects in development
- Azure templates of your own, from git or inline, and Blueprints with Azure slots: a request runs on an agent whose runners are scoped to resource groups, and waits, naming the setting, until the account's agent is; an inline source is checked at publish for what the agent refuses — its own sign-in, a renamed provider, provider registration, a resource group made, OpenTofu state read in development
- Blueprints in the library: a network, a database and a service; Kubernetes with an Istio mesh across clusters available now
- A service account per template on Google Cloud, impersonated by the agent, its custom role only the template's documented policy and its own part of the state bucket available now
- Runners for templates of your own: the AWS, Google Cloud and Azure runners modules make one per template, scoped as the library's are, and a template of yours never runs as a library runner available now
- Stopping an EC2 instance through an approved request, from its resource page, verified by the next complete collection available now
- An expiry on a request that opens its destroy request planned
- In-place updates of a provisioned stack not in v1
Platform
- Users, roles and teams; sessions with a per-user cap; step-up for destructive administrator actions; the audit trail available now
- Connecting an account from the portal: register an AWS account, a Google Cloud project or an Azure subscription, with the template and the exact commands to run in the customer's cloud (an AWS account's with its external id), verification before it is enabled, collection paused and resumed, one collection now, and removal — the CLI is needed for none of it available now
- The Admin area — the organisation, the audit log and an overview of the licence, the people and the accounts — and each user's own settings: profile, sessions, notifications, preferences available now
- Team scope: a member sees the spend, the anomalies, budgets and forecasts, the change feed and the provisioning requests of their own teams' accounts, and no other team's; the inventory and its status history are every member's (PLATFORM.md §4) available now
- First run: a checklist from connecting an account to the first request, a guided tour over the real pages, and a Help menu available now
- Backups and a restore that does not replay cloud changes (the runbook, "Backing up and restoring the database") available now
- Single sign-on through the organisation's OpenID Connect provider (Entra ID, Okta, Google, IAM Identity Center), beside passwords or enforced with break-glass administrators; with the Enterprise licence's
ssocapability available now - Directory group sync: teams bound to the provider's groups, membership following the directory available now
- One home identity: with more than one cloud, the platform signs in at one and the others federate from it, with AWS or Google Cloud as the home available now
- Azure as the home identity in development
- SAML single sign-on and SCIM provisioning planned
- The AI reviewer channel: alerts and cost anomalies handed to an operator's own reviewer as claim checks, its answer on the subject and in the inbox, with evidence the tenant can see; sent from the page that asked available now
- The reviewer service itself, run by the operator, with a local model first (the owner, 2026-10-08) available now
- Triage: a small model the operator runs beside the platform decides for each status change, cost anomaly, budget, provisioning event, change and finding whether it needs people, the AI reviewer or nobody; shadow first, routing unchanged, every decision recorded with its confidence and its agreement with what people did, per kind in Admin available now
- Triage routing events by its decision, within floors and thresholds, once a kind is switched to enforce in development
- Usage that departs from a resource's own history, raised as an event for Triage available now
- Read-only API tokens for the API's GET routes available now
- The operator's manual, served to administrators inside the product available now
NEXT / EVALUATION
See it with your team.
Tell us which clouds you use and what you want to evaluate. Start with a guided demo and discuss access for your team.
Open the demo