Access control

jalth uses three independent access layers, each powered by a different Cloudflare product:

Layer	Controls	CF Product	Example
Mesh membership	Who can join	WARP enrollment policies	SSO login or auth key
Mesh management	Who can manage	Access Groups	Only admins can destroy
Service access	Who can reach a URL	Access Apps (per service)	--allow group:devs

These layers are independent. An external user can access a public service if they match --allow. A mesh member can reach any device at device.mesh:port without a service policy.

Mesh membership

The jalth-members Access Group is the enrollment boundary.

jalth role set sarah@team.com member
jalth group add members --domain myteam.com
jalth role ls
jalth group remove members sarah@team.com

Management roles

Admin (jalth-admins)

• jalth destroy, jalth upgrade, jalth devices remove
• jalth auth-key create/list/revoke
• jalth role set/ls

Operator (jalth-operators)

• jalth route add/remove
• jalth auth-key create/list/revoke

Member (default)

• jalth serve/stop on own device
• jalth ssh, jalth leave
• jalth status, jalth devices, jalth ping (read-only)

jalth role set alice@team.com admin
jalth role set bob@team.com operator

Per-service policies

Set on jalth serve with --allow:

jalth serve api --port 3000 --allow email:alice@team.com
jalth serve grafana --port 3000 --allow group:engineers
jalth serve admin --port 8080 --allow ip:203.0.113.0/24

Supported allow types: email:, group:, ip:, country:.

Custom Access Groups

jalth group create devs
jalth group add devs alice@team.com bob@team.com
jalth group members devs
jalth group delete devs

Headless device identity

jalth auth-key create --name gpu-box --identity ops@team.com --group operators --reusable

The --identity flag assigns an email for role checks. No IdP verification — the auth key proves authorization.