---
title: "Restrict console sign-in with access rules"
description: "Allow console sign-in only from listed networks or during set hours, for the whole organization or for one person."
url: "https://support.outpostplatform.com/depot/access-rules/"
product: "depot"
type: "how-to"
status: "draft"
ai_summary: "Access rules limit where and when people sign in to the Outpost console. Settings > Access rules sets organization-wide allowed networks (IPv4 or IPv6 addresses and CIDR blocks) and allowed hours per weekday in a timezone. Settings > Team > Sign-in rules adds narrower rules for one person. Rules are checked at sign-in and on every request, with a lockout warning on save."
availability:
  plans: ["home-lab", "essentials", "enterprise", "msp"]
  permission: "client:manage"
  preview: false
source: "https://gitlab.com/outpostplatform/docs/-/edit/main/src/content/docs/depot/access-rules.md"
license: "CC BY 4.0"
---

# Restrict console sign-in with access rules

Access rules limit where and when people can sign in to the console. You can
allow sign-in only from listed networks, such as your office or VPN, only
during set hours, or both. Rules set for the organization apply to everyone,
and you can add narrower rules for one person.

## How the rules work

- Rules are checked when someone signs in, after their password has been
  verified, and again on every request they make. A session that started inside
  the allowed hours stops working when the hours end.
- Signing out is always allowed.
- A person refused by a rule sees **Your organization does not allow sign-in
  from here right now. Contact your administrator.** The message does not say
  which rule refused them.
- A person's own rules are added to the organization's, not swapped for them.
  A sign-in has to satisfy both, so a personal rule can narrow access but never
  widen it.

## Before you begin

- Changing the organization's rules needs `client:manage`, which among the
  built-in roles only the owner holds. Viewing them needs `client:read`.
- Changing one person's rules needs `user:manage`.
- Know the public address or addresses your team signs in from. The console
  shows the address it sees for you.

:::danger
Rules that do not include the network you are on, or the current time, lock you
out as soon as you save them. Keep another owner's account, on another network,
able to sign in while you test new rules.
:::

## Set rules for the organization

1. Go to **Settings** > **Access rules**.
2. On the **Networks** card, choose **Allow sign-in from anywhere** or **Only
   from these networks**.
3. If you chose **Only from these networks**, enter one address or CIDR block
   per row, for IPv4 or IPv6, such as `203.0.113.0/24` or `198.51.100.7`.
   Select **Add a network** for more rows. A bare address means that address
   only. Anything not listed is refused, even with a correct password.
4. On the **Hours** card, choose **Allow sign-in at any time** or **Only during
   these hours**.
5. If you chose **Only during these hours**, choose the **Timezone** the hours
   are read in.
6. For each day, select **Add hours** and enter a start and end time. A day
   with no hours shows **Closed all day.**
7. Select **Save sign-in rules**.

The start time is inside the window and the end time is outside it, so `09:00`
to `17:00` lets someone in at nine and refuses them at five. For an overnight
shift, add hours on both days.

If the rules you are saving would refuse the address you are signing in from,
the console warns: **These rules do not include** your address **, which is
where you are signing in from. Saving them will lock you out until another
owner changes them.** Select **Cancel** to fix the rules, or **Save anyway** if
you mean it.

## Set rules for one person

1. Go to **Settings** > **Team**.
2. On the person's row, select **Sign-in rules**.
3. In **Sign-in rules for** the person's name, choose **Use the organization
   rules** or **Set rules for this person**.
4. If you chose **Set rules for this person**, set **Networks** and **Hours**
   the same way as for the organization. Hours are read in the organization's
   timezone.
5. Select **Save sign-in rules**.

You can set rules for your own account. The same lockout warning applies.

## Verify

The page shows **Saved.** Ask a colleague to sign in from a network that is
not listed, or outside the allowed hours. They see **Your organization does not
allow sign-in from here right now. Contact your administrator.**

## Next steps

- [Invite your team](/depot/invite-your-team/)
- [Manage your console account](/depot/account-security/)