# Access a private route

Enrol a device once, then grant Team members access to private applications.

Canonical: https://docs.deliberate.space/private-net/connect/

Enrol each device once, then use that device to open every private route you are
allowed to access. Access is granted to a Team member, not to an individual VPN
configuration.

## Enrol a device

Open **Private Net → This device** in the console and follow the generated setup
instructions. Once connected, the console reports whether the current browser
is Private-Net capable. The same device can then reach any private route the
person is allowed to access.

<figure class="docs-screenshot">
  <img src="/screenshots/private-net-devices-dark.png" alt="Private Net device page showing browser connection status and the action to enrol the current device" loading="lazy" />
  <figcaption>Enrol a device once; access to private routes is then granted to the Team member rather than to individual WireGuard configurations.</figcaption>
</figure>

The CLI exposes the same model:

```sh
deliberate net devices
deliberate net people
```

## Make a route private

```yaml
resource: route
host: admin
visibility: private
allow:
  - owner
  - "@max"
rules:
  - to: app
```

`allow` names Team members or built-in Team roles. Removing access in YAML and
applying revokes the route grant without asking the person to replace their VPN
configuration.

Private routing is an option, not the default onboarding path. Keep first-run
setup public when an uninitiated user must open it before Private Net access has
been established.

## Next steps

- [Grant and revoke Team membership](/teams/access/)
- [Configure public and private routes](/build/configuration/)
- [Review network and application security boundaries](/security/)