Network access doesn't have to mean network membership.

Different tools solve different problems.

SkiMasque is specifically designed around identity-aware network access for workloads and developer commands.

Comparison matrix

Approach	Primary abstraction	Typical access model
Traditional VPN	Network	Join a private network
Mesh VPN	Machines/networks	Connect trusted nodes
ZTNA	Applications/users	Identity-based application access
Bastion	Infrastructure	Connect through a controlled host
PAM	Privileged access	Manage privileged sessions
SkiMasque	Workload network access	Temporary policy-controlled network capability

VPNs are designed around network connectivity.

A user or machine joins a network and can then reach resources permitted by network configuration.

SkiMasque starts with an access request.

Traditional access

Traditional access: a CI job connects through a VPN to the whole network.

SkiMasque

SkiMasque access: a CI job proves an identity, a policy allows one destination, and a temporary session carries the traffic.

Traditional access reaches a whole network; SkiMasque reaches one destination for a limited time.

Mesh VPNs are useful when the fundamental requirement is connecting machines or networks.

SkiMasque instead focuses on making the workload and access request the unit of authorization.

ZTNA systems commonly focus on identity-aware access to applications.

SkiMasque is designed around network-level connectivity for developer and workload workflows where arbitrary protocols may matter.

A bastion provides a controlled entry point into infrastructure.

SkiMasque can provide temporary network connectivity without requiring every workflow to become an interactive bastion session.

Putting CI runners inside a private network is a straightforward architecture.

But it makes network placement part of the security model.

SkiMasque allows workloads to remain outside the private network while receiving narrowly scoped access.

Choose an approach based on what you need to connect: networks, machines, applications, or a workload performing a specific task.

SkiMasque makes the authorization decision around:

The workload and its request.