# Personal access: choose the least-privileged path
> Checked · 20 October 2026 · Wiki version 2026.10.20.2
Most staff should use approved dashboard access. Technical operators use their own Tailscale identity and SSH key to reach the office mini only after owner approval.
## Purpose
Give macOS, Windows, and Linux contributors a safe access checklist without distributing private keys, assuming Tailscale SSH, or treating installed tools as proof of identity.
## Diagram text alternative
A contributor creates a personal key, joins Tailscale through an invitation, receives authorisation, verifies the host fingerprint, then uses the coproperty-office SSH alias. Staff dashboard access is a separate least-privileged path.
## Current / proposed status
- Current: Checked — personal-key and approved-access requirements are documented; an individual connection still needs its own verification.
- Proposed: Complete a first connection only with own keys, a Tailscale invitation, admin authorisation, and owner-verified host fingerprint.
## Safe example
### A safe first-access request
Ask for an invitation to the company Tailscale network and approval of your public SSH key. Verify the owner-approved fingerprint before trusting the alias. If you only need the staff dashboard, request that instead of SSH.
## Responsibilities
- Each contributor creates and protects their own SSH key pair.
- The owner or admin approves the public key, Tailscale identity, and first access.
- The contributor verifies alias, hostname, fingerprint, project path, and status before work.
- The shared Unix account does not replace individual identity or permission controls.
## Checklist
- Use personal SSH keys and personal/approved GitHub identity; never install a bundled private key.
- Join Tailscale with an invited identity and obtain admin authorisation.
- Use standard SSH through alias coproperty-office; do not assume Tailscale SSH.
- Verify the owner-confirmed fingerprint before trusting the first connection.
## Ask for dashboard access before SSH when it is enough
**Status:** Checked
The usual staff entry point is the approved dashboard. It lets a teammate read company information and use role-enabled features without becoming an infrastructure operator. A technical operator path exists for people who need to work on the office computer itself, and it requires explicit owner approval.
This distinction is not a judgement about trust. It is a practical way to minimise access and keep operational and infrastructure responsibilities understandable.
**Current / proposed status**
- Current: Checked — staff and technical access are documented as different paths.
- Proposed: Start every access request by naming the task and the least-privileged surface that can perform it.
**Expected outcome**
People receive only the access needed for their work and have a clear reason for it.
**Meaningful tests**
- Check dashboard is presented before SSH in the page and Markdown export.
- Check all external service links say existing authorised account required.
## macOS, Windows, and Linux use your own key and approved network identity
**Status:** Checked
macOS: install Tailscale from https://tailscale.com/download/mac, sign in with your invited company identity, and open Terminal. Check `ssh -V`, then create a personal key with `ssh-keygen -t ed25519 -f ~/.ssh/coproperty_office`. Choose a passphrase and send only ~/.ssh/coproperty_office.pub to the access administrator. Keep the private file on your computer.
Windows: install Tailscale from https://tailscale.com/download/windows and join the invited company network. In PowerShell, check `ssh -V`. If it is missing, use Microsoft’s OpenSSH Client instructions at https://learn.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse. Run `ssh-keygen -t ed25519 -f "$HOME/.ssh/coproperty_office"` and send only the resulting .pub file. Arrange an observed first connection; installing the client does not grant access.
Linux: follow https://tailscale.com/download/linux for your distribution and install its OpenSSH client. In a terminal, check `ssh -V`, then run `ssh-keygen -t ed25519 -f ~/.ssh/coproperty_office`. Choose a passphrase and send only ~/.ssh/coproperty_office.pub. Join the invited Tailscale identity before connecting.
After approval, ask the administrator to confirm your SSH alias configuration and the host fingerprint below. Run `ssh coproperty-office`. Success is a shell on the expected company mini; verify `hostname`, `whoami`, and the project path before any change. If access is denied or the host key changes, stop and contact the administrator. Do not install a private-key bundle. A shared Unix account does not isolate permissions. Setup prepares your device but does not grant access on the mini.
**Current / proposed status**
- Current: Checked — platform preparation is documented; each person’s actual access remains subject to invitation and approval.
- Proposed: Use a supported, observed first connection for Windows and any unfamiliar device configuration.
**Expected outcome**
Each operating system follows the same identity and approval model without sharing credentials.
**Meaningful tests**
- Check macOS, Windows, and Linux are each mentioned with personal-key guidance.
- Check no command in generated output creates, imports, or distributes someone else’s private key.
## Verify the host before you trust the alias
**Status:** Checked
Use the standard SSH alias `coproperty-office` only after verifying with the owner that it resolves to `copropertys-mac-mini.tail3ab9e5.ts.net`, user `coproperty`, and the pinned host fingerprint `SHA256:UUFmlsdclEmRtyRWNqAdVYUoFxeUkRUGhbzObQPsOPg`. Do not assume Tailscale SSH; this contract uses standard SSH over the approved private route.
Once connected, first verify hostname, project path `/Users/coproperty/Projects/coproperty-office-os`, and repository status. Installed Codex at `/Users/coproperty/.local/bin/codex` is a local tool path, not evidence that a teammate is authenticated; use a personal or approved identity.
**Current / proposed status**
- Current: Checked — the target contract is documented; first use still requires owner verification and personal approved authentication.
- Proposed: Record any changed host fingerprint or target contract through an owner-approved documentation update, not a guess.
**Expected outcome**
A contributor connects to the intended machine and validates the actual work surface before taking any action.
**Meaningful tests**
- Check the exact target contract is available in every contextual work draft.
- Check no Codex URL includes a remote path parameter or tries to open a remote shell.
## Related pages
- [Contribution: isolated workspaces, meaningful tests, reviewed release](/contribution/workspace-and-pr/) — A safe change begins by verifying the remote target, then uses an isolated worktree outside the installed project. It is tested, submitted as a pull request, and reviewed before a person releases it.
- [The Mac mini: authoritative writer and local operating core](/systems/mac-mini/) — The office Mac mini holds internal company state and runs configured operating processes. It is the authoritative writer for internal tasks, decisions, identity links, and audit state.
- [Service directory: approved destinations, not shared access](/reference/service-directory/) — This directory names the approved service destinations used around Co.Property. Every destination requires an existing authorised account or approved auth; the wiki never stores tokens, credentials, or private logs.
## Source pointers
- Handoff / pages/access.html
- Handoff / pages/infrastructure.html
- Handoff / START-HERE.html
## Context export
- Page context: ./exports/contribution--access.context.json