Device approvals (Warden)

With approvals on, a device that registers is not on your network yet. It waits in the Warden inbox; you decide.

Turn it on

Settings → Authentication → Peer Approval. The change is recorded in the activity log. Devices already on the network are not affected; every device that registers from now on waits.

What a waiting device can do

Nothing on the mesh. The control plane withholds its network map: it receives no peers, no routes, no DNS, and approved peers do not learn about it either. It is registered, it has an address, and it is isolated in both directions. Isolation is enforced by the control plane, not by the client, so a modified client gains nothing.

The Warden inbox

Warden in the sidebar lists every waiting device with its mesh address, operating system, how it enrolled (setup key or user) and when it was last seen.

Approve all admits every waiting device, one audit event each. The same actions exist on the Peers page under each row's menu, and the Pending Approvals filter shows the count.

Revoke later

From a peer's row menu choose Revoke approval. The device drops off the mesh within a sync cycle and returns to the inbox. Use it for a lost laptop or a machine you no longer trust; use Delete to remove it entirely.

Audit trail

Every step is an event in Activity: approvals enabled or disabled, device added, device approved, approval revoked, with who did it and when.

Automation

Everything Warden does is available over the API, so approvals can be scripted or wired into a ticketing flow:

curl -X PUT https://mesh.example.com/api/peers/<peer-id> \
  -H "Authorization: Bearer <token>" -H "Content-Type: application/json" \
  -d '{"name":"...","ssh_enabled":false,"login_expiration_enabled":true,"inactivity_expiration_enabled":false,"approval_required":false}'

Many at once, one audit event each:

curl -X POST https://mesh.example.com/api/peers/approvals \
  -H "Authorization: Bearer <token>" -H "Content-Type: application/json" \
  -d '{"peer_ids":["<id-1>","<id-2>"],"approve":true}'
# → {"updated":["<id-1>","<id-2>"],"failed":[]}

Personal access tokens are created under your user menu.