Allow access while travelling

Data access is allowed only from Germany. An employee works from Thailand for two weeks and needs their data during that time—only them, only from there, only until they return, and with a code.

A sign-in rule by country denies everything outside Germany. A time-limited exception on this rule exempts exactly the combination of person and country until a given time. After that, the rule applies again by itself; the expiry is recorded in the change log.

1. Load the geolocation database if not done yet (set-geoip-source, update-geoip; see administration). Without it, no request has a country, and the rule denies everything from outside.

2. Save the rule and the exception in one step (save-sign-in-rule); if the rule already exists, with its id—the command then replaces it with all its exceptions:

   { "id": 7, "scope": "Data", "effect": "Deny", "label": "Germany only",
     "exceptCountries": [ "DE" ], "exceptFrom": [ "10.0.0.0/8" ],
     "exceptions": [ { "persons": [ "Frank Mustermann" ], "countries": [ "TH" ],
                       "until": "2026-11-02T00:00:00Z", "label": "Business trip" } ] }

   until is UTC. Choose the end generously for the destination's time zone.

3. Check: explain-sign-in with an origin { "name": "Thailand", "address": "203.0.113.7", "country": "TH" } shows allowed or code for Frank and the exception under spared; for another person, denied.

Result: Frank works from Thailand until November 2; every other person, and Frank from any other country outside Germany, stays denied. After the end, the rule applies without any further step.

• The country is a hint, not proof. A hotel VPN or a mobile network can show a different country. If Frank reports a denial, SignInEvents shows the detected country; then add that country or the network (from) to the exception.
• Not knowing never exempts. A request without a recognizable country doesn't meet the exception.
• Finding newCountry. Sign-in pattern checking reports the first sign-in from Thailand as a question to the person (level ask), even though it was allowed; that's intended.
• An expired exception stays until you remove it.

• Tier access by location
• HTTP: sign-in—time-limited exceptions
• Zero Trust and private devices