Audience question: for the native-console flow, why not skip the HTTP tunnel and just let the client install a binary that talks VNC directly? Answer: going through ManageIQ lets the cloud management app enforce RBAC, one-time passwords, quotas and scoped temporary access — features a direct VNC connection cannot provide.