Reach managed devices without leaving permanent SSH access behind.

Short-lived grants, explicit policy, and strict host identity verification for every session.