Who it's for¶
RG Platform is for anyone who operates IP-enabled hardware that lives on networks they don't fully control and can't easily reach inbound. Each segment below shares the same core need — reach, unify, and govern remote devices — but values a different RG mechanism most.
Network & infrastructure operations¶
Teams running routers, switches, gateways, and edge appliances across many sites face devices scattered behind CGNAT, cellular backup links, and customer firewalls. The condition that defines them is that no two sites share a network they administer end to end. RG's outbound-only connectivity means each appliance dials out to its cluster and appears in one inventory without per-site firewall changes or public IPs. The device shadow gives a uniform view of configuration and drift across mixed models, and two-tier RBAC scopes who can change what per region. Native GUI access covers the vendor-specific screens an API doesn't expose, and every change lands in the audit trail with actor, target, and outcome.
Industrial & OT¶
Operators of PLCs, industrial gateways, HMIs, and controllers work under strict segmentation, where control networks are firewalled off and often have no inbound path at all. The mechanism that matters most is outbound-only reachability combined with air-gap-capable clusters: a controller initiates one outbound channel, and the cluster that manages it can run entirely on-premises with local identity, RBAC, and audit. Adapters normalize disparate controller APIs into one device shadow, so configuration parity and firmware state are visible across a plant. When a controller exposes only a native dashboard, that dashboard is tunneled and access-controlled rather than exposed. The result is centralized management without punching inbound holes into an OT segment.
Physical security & surveillance¶
Teams managing cameras, access controllers, intercoms, and recorders run large fleets of mixed-vendor devices, frequently on isolated or bandwidth-constrained networks. Their defining condition is heterogeneity: dozens of models and firmware revisions under one operations team. RG's adapters and device shadow bring them under a single control surface, native GUI access reaches the vendor-specific corners, and for media-capable units an operator can open a low-latency live preview in the browser over the device's existing tunnel. Pull-based control tolerates the intermittent links these sites often have, and per-device RBAC limits who can view or reconfigure sensitive hardware. Audit logging records every native-GUI session and configuration change for investigations.
Energy & utilities¶
Operators of grid sensors, substation equipment, metering gateways, and remote telemetry units manage widely dispersed hardware on private and cellular networks, often in locations with no reliable inbound path. The mechanism they rely on is outbound-only connectivity with self-healing reconnection: agents reconnect with backoff after link loss, and clusters reclaim stale endpoints. Regional autonomous clusters keep local operation running through wide-area disruptions, and air-gapped operation suits sites that must never touch the public internet. The device shadow standardizes monitoring — liveness, configuration version, firmware — across vendors, and audit records satisfy the compliance obligations common in regulated utilities.
Transportation & field operations¶
Fleets of in-vehicle gateways, trackers, kiosks, and roadside units move across cellular networks with changing addresses and frequent disconnection. Their condition is mobility: no stable IP, no forwarded port, intermittent coverage. RG's outbound-only tunnels reattach automatically as the network changes, and pull-based control means a device applies configuration, reboot, or upgrade signals whenever it next reaches its cluster rather than requiring a live inbound session. The device shadow tracks each unit's reported state and firmware regardless of where it currently is, so operators manage a moving fleet as one inventory instead of chasing individual endpoints.
Enterprise IoT¶
Enterprises deploying building sensors, environmental monitors, badge readers, and connected equipment across facilities face fleets too large and too varied for per-device management, on corporate networks with tight egress policies. The mechanism that fits is a single outbound connection per device — auditable and easy to allow through egress filtering — feeding a device shadow that unifies vendors under one schema. Two-tier RBAC lets central IT delegate scoped control to facility teams, tenant isolation separates business units on shared infrastructure, and monitoring rolls device, node, and cluster health up to an organization-wide inventory. Native GUI access covers legacy equipment that predates any usable API.
MSPs & integrators¶
Managed-service providers and system integrators operate devices they don't own, across many customers, on networks they can't standardize. Their defining need is multi-tenant isolation with clean delegation. RG enforces tenant isolation at the query, allocation, and audit layers, so one customer's devices are invisible to another, and cross-tenant lookups return "not found". Two-tier RBAC and per-customer scoping on a shared cluster let a provider grant a customer visibility into only their own fleet, while white-label deployment presents the provider's brand. Each customer can be moved to a private or on-premises cluster when contracts require it, without changing the identity or permission model.
Regulated & sovereign¶
Defense, public-safety, and critical-infrastructure operators run under mandates that forbid external connectivity and require a complete, local, provable record. Their condition is sovereignty: data and control must stay within a controlled boundary. RG's air-gapped cluster is a first-class mode — local identity, local RBAC, local audit, and full operation with zero external connectivity — not a degraded subset. On-premises deployment keeps every component inside the operator's environment, audit is retained locally and exported on demand, and reconnection (if ever permitted) reconciles safely. This suits classified sites and any environment where cloud dependence is disqualifying.
Broadcast & media¶
Broadcasters and media operators running encoders, streamers, and contribution hardware are one segment among many, not the platform's focus. Their devices are managed exactly like any other IP device — outbound-only tunnels, a device shadow, adapters, and native GUI access — with one extra convenience for media-capable units: an operator can view a low-latency live preview in the browser, carried over the same tunnel the device already holds for control. Nothing else in the platform depends on that path; a device without a media stream simply doesn't use it.