My devices

The config box appears once, when the device is registered, and the subnet controls live in it. A device from an earlier visit is left with deactivate and delete: the portal never stored its private key, so anything it rendered now would download fine and then not connect. Register a new device and delete the old one.

Administration — portal generation –

Agents — an agent's addresses are the site's device pools

Temporary access — lets a user reach the portal from one address before they have a tunnel

Users — read from Authentik, put into access groups here

Who is on this list is Authentik's answer and cannot be changed here. Which access groups they are in is the portal's, and is changed here. Someone removed from the Authentik groups, or deactivated there, has their devices deleted on the next pass and their tunnel drops with it. That is not reversible: rejoining brings nothing back, they register a device again and download a new config. Their access groups do come back, because those say what the person is meant to reach and that does not stop being true while they are away.

Access groups — what a member reaches, decided here and not in Authentik

Targets — a named set of destinations, opened on every port

A target is addresses and nothing else, so it opens the machines in it on every port, SSH included. A narrower grant is a narrower target.

reading the policy…

A device whose owner is in no group at all is left alone and reaches what it reached before any of this existed. Putting someone in a group is therefore the moment their access narrows to that group. Everyone reaches the internet, and reaches nothing regardless of their groups.

All devices