#access-control

Routes and policy: giving the mesh the keys, one team at a time

An authenticated peer that can't reach anything is useless. This part turns the gateway into a routing peer, advertises the internal network, pushes internal DNS, and replaces 'connected means full access' with default-deny, group-based policy.