Pending
A valid identity creates a request; ordinary Internet remains blocked.
Integration at a glance
Allowed
The business authorizes that individual identity at its location.
Applied
Confirm authentication, fresh reports and gateway acknowledgement.
Target supported hardware and an enabled site. Your application retains its own health and recovery responsibilities.
Request and decision
The business sees a verified manufacturer, product, device identifier, requested role, and recent attempt. Manufacturers see that their device is waiting for approval.
Repeated attempts refresh a single request instead of producing duplicate requests. Invalid or unknown credentials do not appear as trusted manufacturer requests.
- Review the device request in the site dashboard.
- Select Allow device or Deny.
- For an allowed device, wait for automatic retry and an observed successful connection.
- Confirm the specific function you need: Internet access for a client, or backhaul and AP activation for a satellite.
Persistent permission and revocation
Approval persists across reconnects for the same identity and site until revoked. Credential renewal and a MAC change do not create a new device identity. A different location requires permission there.
Revocation removes site authorization and requests disconnection. Enforcement remains pending until the reachable gateway acknowledges it. A dashboard decision alone is not proof that an unreachable router has applied it.
Managed satellite setup
Power on an enrolled, compatible satellite within gateway range and approve it in the dashboard. The ordinary installation path needs no mandatory QR scan, network password entry, cable connection, BSSID entry, or SSH session.
After approval, confirm secure backhaul, applied configuration, active client Wi-Fi, and recent reporting. Reposition the satellite only while it retains an adequate backhaul signal. Legacy satellites require deliberate reprovisioning.
Responsibility boundaries
Permission does not claim or transfer ownership. A manufacturer cannot override a business denial. Provider delegation does not automatically grant site admission.
A functioning gateway and Internet uplink are required. Offline commissioning and multi-hop mesh are outside the initial supported experience.
Diagram and flow
- DEVICE AUTHENTICATION
Present a valid identity
An enrolled device attempts EAP-TLS at an explicitly enabled site.
Valid identity → Allow this device? - SITE OWNER
Allow this device?
The business reviews the individual connection request.
Allow → Retry and connectOtherwise → Keep access blocked - ALLOWED
Retry and connect
Automatic authentication retry applies the approved local policy.
Fresh status → Observe and reconnect - PENDING / DENIED / REVOKED
Keep access blocked
The manufacturer sees the decision. It cannot override a denial.
- ONGOING OPERATION
Observe and reconnect
Permission persists at this site until revoked. Check fresh evidence.
Read the diagram description
- DEVICE AUTHENTICATION — Present a valid identity. An enrolled device attempts EAP-TLS at an explicitly enabled site.Valid identity → Allow this device?.
- SITE OWNER — Allow this device?. The business reviews the individual connection request.Allow → Retry and connect.Otherwise → Keep access blocked.
- ALLOWED — Retry and connect. Automatic authentication retry applies the approved local policy.Fresh status → Observe and reconnect.
- PENDING / DENIED / REVOKED — Keep access blocked. The manufacturer sees the decision. It cannot override a denial.
- ONGOING OPERATION — Observe and reconnect. Permission persists at this site until revoked. Check fresh evidence.