Identity and Device
An account identifies the person or administrator. A registered Device identifies the endpoint using the App or ns. Neither alone decides every destination it can reach.
Security operations
Know the identity, the Space and the exact access path.
Operate NetSeed from explicit boundaries: accounts and Devices, one active Organization and Network Space, same-account system rules, directional cross-account Grants, independent NSGW roles and visible control events.
Identity + DeviceOrganization + NetworkSystem rule + explicit Grant
Access decisionQuick G · Production
SourceAccount + Devicecurrent local identity
ContextCurrent SpaceOrganization + Network
DecisionSystem rule or Grantsame-account · cross-account
DestinationNode · Service · Exitonly the selected scope
Authentication establishes identity; authorization still belongs to the active Space.
The operating model
Six boundaries an operator can inspect.
Each answers a different question. Keeping them separate prevents an online status or successful sign-in from being mistaken for authorization.
Organization and Network
The Organization holds ownership and membership. The Network holds resources and access configuration. Their selected pair is the current Space, and only one Space is active.
Node or Service
L3 Node access covers an authorized machine and leaves the destination firewall final. L4 Service access narrows the destination to its declared protocol, host and port.
System rule or Grant
Same-account access to its own Nodes and private Services is system-managed. Cross-account sharing requires an explicit directional Grant to the selected resource.
Gateway role
Relay, Service Egress, Internet Exit and Public Ingress report readiness independently. A gateway being online does not mean every role is ready.
Activity log
Administrative and system events expose actor, action, resource, time and outcome, with filters and event details for investigation.
Authorization boundaries
Same account and cross-account access are intentionally different.
The immutable same-account system rule lets an account use its own Nodes and private Services. Sharing with another account is a separate, directional decision represented by an explicit Grant.
Same account
System-managed access covers the account's own Nodes and private Services in the current Space.
Cross-account
A Grant selects the subject and resource direction. Reverse access is a separate decision.
L3 final boundary
The destination host firewall remains authoritative after a Node is authorized.
L4 final boundary
The declared Service limits the path to a specific protocol, host and port.
Authorization comparisonCurrent Space
Same accountAccount → own Node / private Serviceimmutable system rule
Cross-accountSelected subject → selected Node / Serviceexplicit directional Grant
Destination enforcementHost firewall or declared L4 endpointauthorization does not erase the resource's final boundary
Gateway operations
Monitor the role the selected path actually needs.
NSGW exposes four independent capabilities. Operations should alert on the required role and its current configuration, rather than treating the gateway's generic online state as proof of service readiness.
Relay
Supports a relay path when the selected connection needs it.
Service Egress
Provides egress from the gateway toward a configured private Service backend.
Internet Exit
Carries an authorized IPv4 default route or selected IPv4 CIDRs when configured.
Public Ingress
Accepts configured public L7 or L4 entry paths with their distinct authorization models.
NSGW · sg-edge-01Online
Relayindependent readiness
ReadyService Egressindependent readiness
ReadyInternet Exitindependent readiness
CheckPublic Ingressindependent readiness
ReadyExample composition: online and per-role readiness are intentionally separate.
Activity and delivery evidence
Investigate control changes before exporting them.
The Activity log is the primary record for administrative and system events. HMAC-signed Webhooks and external audit export can extend that workflow when configured, but they do not replace the source event or create a certification claim.
NSD / Activity log fields
time 2026-08-29T10:42:18Z
actor operator@example.com
action policy.update
resource production-access
outcome success
Filter and inspect the stored event before correlating it elsewhere.
Operate from explicit state
Check the Space, rule, resource and role—not just “online.”
Use NSD for current configuration and Activity events, then use the product documentation for the exact recovery and response procedure.