Sovereign Authorization

Management console — the authenticators that authorize soul writes and tier-1 commands, the enrollment seal, and pending authorization ceremonies. Read views are open on the WG/LAN; every change is gated behind your enrolled keys.

Enrollment window …

Loading seal status…

Go to enrollment →

Opening the roster needs both a person factor (Face/Touch ID) and a possession factor (YubiKey). Sealing needs any one enrolled key.

At a glance

·
Authenticators
·
Person factors
·
Possession factors
·
Pending requests

Enrolled authenticators

Authorization requests

Internal · fail-closed · never leaves the WireGuard network.
rpID sas.tsho.us