# verae-access-leaf

**Server-to-server leaf node** access plane. Remote machines connect as NATS leaf nodes (or POST `/forward` with a leaf token). They never get the core billing subjects.

**Forgejo:** https://git.georgelambert.org/marchon/verae-access-leaf

```text
remote leaf  →  verae.access.leaf.in  →  authz.check  →  verae.archive.put | jobs.*
```

Denied: `verae.billing.balance.adjust`, `verae.billing.statement.get`. A compromised WORM/leaf cannot credit customers.

`LEAF_TOKEN` required. Port `:3023`. Do not publish NATS `4222` to the internet; leaf nodes use a private leafnode port / tunnel.