Dynamic IP or short maintenance window
Open SSH only when an operator needs it.
Accept a protected signal, allow the current source, then revoke or expire the path when the work is done.
- Product fit
- Temporary reachability without a permanently broad ingress rule.
- Required boundary
- Firewall behavior, key custody, expiry, and host policy remain operator-owned.