Every connection verified.
No implicit trust. Every connection request is evaluated against your policies in real time. Define who can access what, on which ports, and in which direction.
- Group-based policies (users, devices, networks)
- Direction control: ingress, egress, bidirectional
- Protocol and port filtering
- Access matrix and policy simulator
- Full audit trail for every connection
Access Control Policies
3 activeVerified before it's allowed.
Every connection — SSH, tunnel, or mesh traffic — passes through the policy engine before it's allowed.
Request
User or device initiates a connection.
Evaluate
Policy engine checks identity, role, group, target, port, direction.
Allow or deny
Connection proceeds or is blocked. Both are logged.
Policy, matrix, simulation, audit.
The four primitives that turn "who can reach what" from a spreadsheet into an enforced contract.
Group-based policies
Define access rules using user groups and device groups. "DevOps team can SSH to production servers as root." Simple, readable, powerful.
Access matrix
See who can access what in a single grid view. Instantly spot gaps or over-provisioned access across your entire organization.
| api-srv | db-prod | grafana | |
|---|---|---|---|
| DevOps | ✓ | ✓ | ✓ |
| Backend | ✓ | ✓ | ✗ |
| Interns | ✗ | ✗ | ✓ |
Policy simulator
Test before you deploy. "Can Alice SSH to the database as root?" Simulate any access request without actually making the connection.
Full audit trail
Every connection, every policy change, every login — logged with timestamp, user, device, and result. Searchable, exportable, compliance-ready.
Direction matters.
Not all connections are equal. Control which direction traffic flows between groups.
Ingress
Source can reach destination, but not the reverse. One-way access for least privilege.
DevOps → ProductionEgress
Destination can reach source. Useful for callback or reverse connections.
Monitoring ← All ServersBidirectional
Both sides can initiate connections. Full mesh connectivity between groups.
API ⇄ Database ClusterSee the same policy three ways.
Click through it in the visual editor, or read it as cards or as code. The visual editor is the source of truth today; Git-versioned policy-as-code is on the roadmap.
Drag a line, change a verdict. Click a node to see who's in the group.
policy "prod-rbac" {
allow {
source = ["group:ops"]
destination = ["group:prod-app", "group:prod-db"]
ports = [22, 443]
}
allow {
source = ["group:devs"]
destination = ["group:prod-app"]
ports = [443]
}
deny {
source = ["group:devs"]
destination = ["group:prod-db"]
# developers cannot reach prod-db
}
}Read your rules as code today. Git versioning and a Terraform provider are on the roadmap.
Lock down access in an afternoon.
Free for every feature while we're in beta. Define your first policy in minutes — no implicit trust, always verified.