Org-wide gate that runs at sign-in and on every privileged request. Block or allow by IP / CIDR, country/region, email domain, or phone country. Identity rules (email, domain) are enforced on every page of both shells by pure-access-guard.js. Network rules (IP, country) are recorded and evaluated here but not yet enforced — that belongs at the edge, and this page says so rather than implying a block that does not exist.
Default posture
Rules
Quick geo blocks — not wired yet
These need an edge function: anything the browser checks about the network, the network can lie about. They are kept here as the intended set, and they enforce nothing today — the toggles are disabled rather than pretending.