The Network Is Not the Fleet

"Everything on the network is visible. Almost nothing on the network is yours to manage."

The set trap

Your private network hands you a tidy list of devices, and the tempting shortcut is to call that list the fleet. It isn't. The set of things you can see is much larger than the set of things you manage, and quietly treating them as equal is how a control plane starts reaching for machines that were never its business.

What else is on the wire

Alongside the managed Macs sit a NAS, a couple of phones, a tablet, maybe a family member's laptop. Every one of them is reachable. None of them being reachable makes them fleet members. Reachable is a fact about the network; managed is a decision about authority.

Classification, not enrollment

So discovery doesn't enroll — it classifies. Each device it finds gets an explicit label: managed_mac, candidate_mac, auxiliary_device (the NAS), mom_device, unknown, or ignored. A candidate is a proposal, not a member. Only an explicit enroll operation — never the mere fact of answering a probe — grants management authority.

Some doors are locked by default

The strongest form of the rule: a family member's Mac is excluded by default and cannot enter through the generic Add-Mac flow at all. Bringing it under management would require a deliberate, operation-specific authorization — a door you unlock on purpose. That exclusion isn't a missing feature; it's the boundary working exactly as designed.

Visible is not managed. A device earns a place on the roll by an explicit decision, never by showing up on the network with its lights on.

Code

Discovery labels; it does not enroll·json

discovered = [
  { "seen": "server",         "class": "managed_mac" },
  { "seen": "nas-box",        "class": "auxiliary_device" },  // terminal ok, never a fleet Mac
  { "seen": "a-family-phone", "class": "auxiliary_device" },
  { "seen": "moms-studio",    "class": "mom_device" },        // excluded by default; needs explicit auth
  { "seen": "unknown-host",   "class": "candidate_mac" }      // a PROPOSAL, not a member
]

// Discovery only labels. Turning a candidate into a managed member is
// a separate, explicit enroll operation -- and mom_device cannot take
// that path through the generic flow at all.

Exercise

List the devices on your home network right now. For each, label it: would you manage it, merely watch it, or leave it entirely alone? Notice how few belong in the first bucket, then write one sentence on what would have to be true before you'd move a device from 'watch' to 'manage.'

Hint

The NAS and the phones are almost always 'leave alone' or 'watch.' The moment something becomes 'manage,' you're taking responsibility for changing it — and that's a decision you make, not a status the network hands you.

The set trap

What else is on the wire

Classification, not enrollment

Some doors are locked by default

Code

External links

Exercise

Progress

Comments 0