# An allowlisted IP is not authorization

An IP allowlist can shrink who reaches your edge. It does not decide whether that caller may read invoice #4821 or delete another tenant's project.

Treat network controls as a coarse filter. Still authenticate the subject, then authorize the action against the specific resource. Otherwise a compromised laptop on the office VPN inherits every permission by accident.