Grant Site-scoped access
Make the access decision explicit: choose the person, choose the Site, and grant only what the engagement requires.
The core decision
A collaborator should receive access to the Site that contains the resources needed for their work — not an automatic pass to every environment your organization operates.
- Select a named collaborator
- Select one or more Sites
- Review the assignment before granting access
- Use an expiration when the engagement has a known end
Connect once, grant many Sites
External users run Connect Device once to join the Bstrapr VPN. When you grant Site2 later, Bstrapr updates access policy for their existing Online device — no second Connect code. Revoking Site2 leaves Site1 (and the device session) intact.
- First Site: mint a Connect code if they have no Online laptop yet
- Additional Sites: grant Site access only (ACL) — helper not required
- Revoke is per-Site; the laptop stays Online for remaining Sites
Individual and group assignments
For a one-person engagement, assign an individual directly. For agencies and service providers, assign a provider group to a delegated client Site so its current members receive the group grant. A specialist can be in multiple groups.
Least privilege in practice
- A developer working on Site A does not automatically receive Site B
- A contractor can be assigned for a temporary engagement
- A client can retain ownership while a provider receives delegated access
- Group membership can be changed without changing the whole team
Review before access begins
Use the access overview to see who can reach which Site. Access activity history records grants and changes so owners can review the relationship over time.
This public guide explains the workflow. Environment-specific setup commands, connection details, and administrative controls are available inside the authenticated dashboard.