Deploy and extend9 min
Security model
Reduce public exposure, credential sprawl and lateral reach while keeping operations practical.
Outcome
Outbound connections, isolated routing, explicit policy and revocable user access.
Before you start
- Inventory of users/devices/protocols
- Tenant boundaries
- Recovery paths for production devices
Apply four operating principles
- Keep management services off the public internet.
- Give each device and person a unique identity.
- Authorize the protocol and target needed for the job.
- Make revocation central and test it.
Separate credential layers
- 1Protect enrollment keys and tokens.
- 2Use individual Wantastic accounts.
- 3Keep target credentials in protected workflows.
- 4Rotate only the affected layer after exposure.
- 5Terminate active sessions after high-risk revocation.
Operational note: Overlay membership does not make every peer trusted.
Review boundaries with evidence
- A low-privilege user cannot open an unassigned device.
- An allowed user can use only the intended protocol.
- Public scans cannot reach management services.
- Session/policy history matches representative support work.
Verify the result
No unnecessary public management port.
Individual technician accounts.
Out-of-scope device/protocol denied.
Revocation blocks a new session.
Common issues
A user reaches too much.
Likely cause
A broad role, parent group or inherited topology rule.
Fix
Trace user-to-group-to-device access, remove the broad grant and retest as that user.
Password rotation breaks all access.
Likely cause
The managed entry still holds the old target credential.
Fix
Update it once in the protected entry and retest managed identities.
Continue with
Teams, accounts and auditGive each operator the smallest durable access they need and keep actions attributable.Topology and access policySeparate the network you observe from the paths you intend to allow.Self-host WantasticCoreDeploy the all-in-one open-source control plane and verify day-two operations.