Device authorization

Joining a ZeroTier network requires a device to be authorized. A Beam agent watches for join requests, reads the device identity and the rules your team set, and approves the ones that clearly match an expected device or user. Approved members are recorded and the requester is notified. Requests that do not fit, an unknown identity, a device from an unexpected location, or one exceeding your seat limits, are never approved on their own. The agent holds them and alerts an administrator to make the call, so nothing untrusted quietly gains access to your private network.

Network membership

ZeroTier keeps a roster of the devices, VMs, and apps on each network. A Beam agent reads that membership and keeps it aligned with your source of truth, tagging members, correcting names, and removing entries your rule marks as retired. Changes follow the policy your team approved. When a member looks stale, appears on a network it should not, or a removal would cut off something still in use, the agent pauses and asks a person before acting. Routine tidying happens on its own, while anything that could break connectivity waits for human confirmation first.

Access rule enforcement

Networks carry rules about which members may reach what. A Beam agent reads the current access configuration in ZeroTier and compares it against the policy your team defined, noting members whose permissions have drifted. Where your rule clearly allows it, the agent corrects small mismatches and records the change. Broader shifts, opening access between segments, granting a member new reach, or anything touching sensitive resources, are routed to a security owner to approve first. The agent surfaces the drift and proposes the fix, but a person signs off on changes that widen who can connect.