An approval email should not approve anything
Notifications can carry context. Authority should remain behind the boundary where the decision belongs.
An “Approve” button in an email is convenient because it compresses a workflow into one click.
It also turns possession of a forwarded message, a mailbox session, or a scanned URL into authority over the platform.
For human VPN enrollment in RS Platform, email is allowed to notify and to deliver a bounded setup capability. It is never allowed to make the operator’s decision.
Keep the decision on the private path
An enrollment request can trigger an operator email containing a summary and an ordinary link. Following it does not approve anything.
The operator must reach the private console through the operator WireGuard path, authenticate normally, inspect the request, and explicitly accept or reject it. There is no signed approval token in the message.
Mailbox compromise can reveal that a request exists or delay notification. It cannot grant a peer access.
This is a useful distinction: a notification tells an authorized person where work is waiting; it does not inherit the authority to perform that work.
Setup links are capabilities, so bound them
After approval, the user does need a way to begin setup. That link is treated as a capability rather than disguised as harmless navigation.
It is short-lived, single-use, stored as a hash, and bound to one user, permission set, address, and enrollment generation. The token travels in the URL fragment so it does not enter ordinary HTTP request logs. The setup page loads no third-party code and sends no referrer.
The browser generates the WireGuard private key locally. Only the public key reaches the server; the final configuration and QR code are assembled on the client. Neither the mail provider nor the platform ever needs the private key.
Recovery must not resurrect authority
Backups complicate single-use tokens. Restore a database from before a token was consumed and the supposedly dead capability may become valid again.
The recovery procedure therefore advances a separate enrollment epoch and invalidates every pending token from the restored state. An operator reviews and reissues what is still legitimate.
This is the part most “magic link” descriptions omit: capability lifetime must survive time travel through backups.
Email should bootstrap identity, not become identity
Returning users authenticate with passkeys. Losing every passkey creates a new request for private operator review; it does not reveal an “email me a reset link” escape hatch.
The mail transport remains pluggable and send-only. It can be unavailable without changing who is authorized. It can be replaced without changing the enrollment state machine.
Convenience is safest when it shortens the distance to a decision rather than silently becoming the decision itself.