Skip to content
docs.deliberate

Connect and grant access

Private Net access is people-first. A person enrols each device once; route access is granted to the person, not to an individual WireGuard configuration.

Enrol a device

Section titled “Enrol a device”

Open Private Net → This device in the console and follow the generated setup instructions. Once connected, the console reports whether the current browser is Private-Net capable. The same device can then reach any private route the person is allowed to access.

The CLI exposes the same model:

Terminal window
deliberate net devices
deliberate net people

Declare a private route

Section titled “Declare a private route”
resource: route
host: admin
visibility: private
allow:
  - owner
  - "@max"
rules:
  - to: app

allow names people or built-in Team roles. Removing access in YAML and applying revokes the route grant without asking the person to replace their VPN configuration.

Private routing is an option, not the default onboarding path. Keep first-run setup public when an uninitiated user must open it before Private Net access has been established.