---
title: Arm and disarm a tenant
description: Assert signed consent to arm a tenant for remote support, and disarm it to end any live sessions.
---

# Arm and disarm a tenant



## Goal

Put a tenant into the armed state so that remote-support sessions can be activated against its agents, or take it back out. Arming is the operator's recorded assertion that the tenant has signed remote-support consent. Disarming ends any live sessions for that tenant.

## Prerequisites

* A PAT with the **`remote_support:arm`** scope. This is a separate privilege model from session activation: no ops-token second factor and no IP gate, but a server-side confirm-token step-up applies (the CLI sets `confirm_tenant_id` to the tenant for you).
* The tenant must actually have signed consent. Consent is hard-enforced server-side: the consent record (flag, timestamp, signed-document ID) must exist, and activation will hard-fail with `tenant_consent_required` regardless of arm state. Do not arm a tenant that has not signed.
* A reason. Every write takes a required `--reason` and it lands in the audit trail.

## Steps: Operations Console

1. Open the Operations Console at `ops.useargus.co` and go to the tenants command-center view.
2. Find the tenant. The tenant list shows each tenant's armed/consent posture and agent counts.
3. Click **ARM** (or **DISARM**) and provide the reason when prompted.
4. The action toasts and the row updates in place on the next refresh tick; there is no full-page reload.

Note: arm/disarm actions are subject to a per-operator rate limit; a burst of actions returns 429 and the console surfaces it.

## Steps: argusctl

```bash
# Arm: asserts signed consent (scope remote_support:arm)
argusctl tenant arm UTD_7ELEVEN_001 --reason "ride-along"

# Disarm: ends any live sessions
argusctl tenant disarm UTD_7ELEVEN_001 --reason "done"
```

The `support arm` / `support disarm` spellings hit the same endpoints. Add `--dry-run` to preview the exact request (method, path, body) without sending it; header values are redacted in the preview.

## Verify

```bash
argusctl tenant ls                      # armed/consent state across all tenants
argusctl tenant show UTD_7ELEVEN_001    # per-tenant readiness checklist
```

`tenant ls` and `tenant show` are browser-safe reads: they need only a PAT with the `remote_support` scope, no ops-token, no IP gate. The console tenants view reflects the same state.

## What disarm does to live sessions

Disarm is a kill switch at tenant scope: it ends any live remote-support sessions for that tenant immediately, not just future ones. The session end is written to the audit trail (`remote_support_session_ended`). An operator mid-session loses the session; re-activation requires re-arming and passing the full activation gate again.

## Troubleshooting

| Symptom                                        | Meaning                                                                                                                                            |
| ---------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------- |
| 403 on arm/disarm                              | Your PAT lacks the `remote_support:arm` scope.                                                                                                     |
| 429                                            | Per-operator rate limit hit. Wait for the window to pass.                                                                                          |
| `tenant_consent_required` later, at activation | The tenant has no recorded signed consent. Arming does not bypass this; consent is a contractual and legal requirement, not a server config issue. |
| `tenant_remote_support_disabled` at activation | The tenant flag is off. Confirm with the tenant before re-enabling.                                                                                |


---

For a semantic overview of all documentation, see [/sitemap.md](/sitemap.md)

For an index of all available documentation, see [/llms.txt](/llms.txt)

For agent-facing discovery, including API and MCP surfaces, see [/agents.md](/agents.md)