Roles & permissions

jalth uses Cloudflare Access Groups for role management. Admin is tied to your identity (email), not your device.

Three roles

Admin (jalth-admins)

Full control over the mesh:

Command	Description
jalth destroy	Tear down the entire mesh
jalth upgrade	Upgrade the Registry Worker
jalth devices remove	Remove other devices
jalth auth-key create/list/revoke	Manage auth keys
jalth role set/ls	Manage roles
jalth domain set/remove	Manage mesh domain

Operator (jalth-operators)

Delegated network management:

Command	Description
jalth route add/remove	Manage egress routes
jalth auth-key create/list/revoke	Manage headless enrollment

Admins already satisfy operator checks.

Member (default)

Any enrolled device:

Command	Description
jalth serve/stop	Expose/unexpose own services
jalth ssh	SSH into devices
jalth leave	Remove self from mesh
jalth status/devices/ping	Read-only mesh state

How roles are assigned

During jalth init, three Access Groups are created:

• jalth-members — who can enroll
• jalth-admins — who has admin powers
• jalth-operators — who can manage routes

jalth role set alice@team.com admin
jalth role set bob@team.com operator
jalth role ls

Headless devices

Headless devices cannot hold admin role. They can satisfy operator checks when enrolled through a non-revoked auth key scoped to operators.

jalth auth-key create --name ci-runner --identity ops@team.com --group operators

Recovery

If all admin devices are lost, the Cloudflare API token holder can re-run jalth init on a new device. Step 3 reconciles the existing mesh and elects the new device as admin.

Last-admin guard

jalth leave refuses if you’re the last admin-capable device. Promote another admin first, or run jalth destroy.