Space Administrator Guide
Restrict access to your entityOS space by IP address — for the whole space and for individual users — directly from the console. This is the platform-native side of Stage 1 IP allowlisting.
console.entityos.cloud › Users › Network Access
The Model
One rule set that applies to every user in the space.
Per-user restrictions layered on top of the space.
Confine access to a fixed set of trusted addresses.
Permit additional addresses alongside the required ones.
Where To Find It
Sign in at console.entityos.cloud. The dashboard's Network Access Rules card shows a live count of the rules already in place — how many apply to the whole space, and how many apply to individual users.
Rules for the whole space live under the "All Users Network Access" screen.
UsersRules for an individual are reached through that user's own record.
Users and select the userScope
The two scopes are not alternatives. A space rule sets the baseline for everyone; user rules tighten or extend it for named people. Both are evaluated together.
Rules stack. Rules set at the space level apply in addition to any rules set against individual users. Plan the two layers together so they don't contradict each other.
Rule Anatomy
Every rule — space or user — has the same three parts. The Use Type is the one that changes behaviour.
| Use Type | What it does | When to use it |
|---|---|---|
| Must | Access is required to come from a matching address. Add one or more "Must" rules to confine the user (or the whole space) to those trusted networks — connections from anywhere else are refused. | Locking a space or account down to a known office range, VPN, or fixed-IP workstation. |
| Can | The address is permitted. "Can" rules add allowed locations on top of the required set, without narrowing access on their own. | Granting an extra trusted site — a second office, a home static IP — alongside the mandatory ones. |
The public IP the connection will arrive from (IPv4 or IPv6). Confirm your current address before you lock yourself in.
Choose Must (required) or Can (permitted) — the switch that sets how the rule is enforced.
A short label so the rule is self-explanatory later — e.g. "Sydney office" or "Mark's home static".
Walkthrough
The flow is the same for both scopes — only the way you reach the "Add" screen differs.
Space-wide rule
Users from the dashboard or the Network Access Rules card.Per-user rule
Users and search for or select the user.Good Practice
Before adding a "Must" rule, make sure your own current IP is covered. Keep a way back in — a second admin or a known static address.
Try changes against a non-admin test account first, and confirm the intended IPs get in — and others don't — before rolling out widely.
Use the Notes field on each rule. Six months on, "Sydney office" is far easier to reason about than a bare address.
IP rules complement MFA. entityOS can also bind an access token to a single IP for the session, tying identity to location.
Allowlisting works best against fixed addresses. Dynamic home IPs can change — use a static IP or a VPN egress you control.
Set up fixed-IP secure access →Revisit rules when offices move, staff leave, or providers rotate ranges. Stale allowlists quietly become open doors.
Stage 1 · In Practice
Network Access Rules are the console-native form of IP allowlisting — a network-layer perimeter you can stand up in minutes, for the whole space or one user at a time.