The Access Manager is one PowerShell window. It runs on Herman’s computer. It controls who reaches which door on the Anchor Node.
Every change travels over SSH to the server. The tool holds no data of its own. The server is always the source of truth: the tool reads the state back after each change.
This file is the admin login. It edits ~/.ssh/authorized_keys. Two refusals protect you:
  • It refuses to remove the last remaining key. That would lock you out of the server for good.
  • It warns harder when the key you remove belongs to this computer. Such a row is marked << THIS PC.

​
Three tabs

SSH machines

Which computers can sign in as herman925. One key is one computer.

Users and doors

The matrix. One row for each person, one column for each door.

Review sessions

Reviewer tokens for webpage-review. These belong to a project, not to a person.

​
The matrix

Each row is a person. Each column is a door. A tick means that the person has an account on that door.
A tick and a dot mean different things. A tick means an account of that person’s own. A dot means the person holds the one shared login for that door. Chat and Hermes are shared logins, so they use dots.
Unticking every box takes access away and keeps the person. Their row stays, so you can grant access again later.
This rule exists because of a real loss. Before the roster was added, the list of people came from door membership alone. Unticking somebody’s last door erased the person, and no row was left to grant anything back to. That is how lin was destroyed on 21 July 2026.

​
What the tool writes

Each door has its own store. The Access Manager does not hold a copy of any of them.
KasmVNC is the source of truth for passwords. Every password change writes the desktop and the file browser first, then the doors that the person holds.

​
The tool checks itself

tools/check-access-manager.ps1 builds the real window off screen, reads the properties that a screenshot would be read for, and then disposes of it.
It runs 142 checks. Run it, and read its PASS and FAIL lines, before you hand any change over.
A browser cannot render a PowerShell window. For this tool the check script is the visual audit. It asserts that the header labels do not touch, that the hint text fits its box, and that every column is assigned from server state.