New hires get everything on day one.
Onboarding scripts grant access to production from day one because nobody wants to issue multiple VPN profiles or tokens. Risk explodes; principle of least privilege dies.
Case 07 · Progressive Onboarding
From Docs to Prod, gradually.
Day 1: Wiki. Week 1: Staging. Month 1: Prod. Grant access to a whole project but disable sensitive domains initially. Enable them gradually as the new hire progresses.
1 token
Grows with the user
Real-time
Updates sync instantly
0
Re-logins needed
01
The problem → L7 Admin Guard way
Roles that grow with the user.
Assign a Project (containing multiple domains) to a single token, but toggle off sensitive domains for the new hire. As they ramp up, the admin enables the disabled domains in the dashboard. The user does nothing—their existing token automatically pulls the new settings and expands their access in real-time.
02
Step by step
01
Create a Project
Group related domains (e.g., wiki, staging, prod) into a single Project.
02
Issue one token
Assign the Project to the new hire's token, but toggle off the production domains.
03
Enable gradually
When the user is ready, simply toggle the domains back on. You don't need to issue a new token or search for domains to add them—you just see the disabled domains right in the token settings and switch them on. The extension checks for updates every 10 minutes (to save battery life) or instantly upon manual refresh. The gateways apply changes immediately.
03
Common questions
- Does the user need to reconnect?
- No. The extension fetches new settings every 10 minutes (to save battery) and can be refreshed manually. Gateways apply changes immediately without dropping existing sessions.
- Does disabling a domain in a token affect other tokens using the project?
- No. If you disable a domain in the token settings, it only affects that specific token. However, if you disable a domain at the Project level, it will be disabled for all tokens using that project.
Ship this in five minutes.
Live demo, no signup. Or grab the trial — every feature, fourteen days, no card.