---
description: Isolation between private networks and who can change them
revision_date: 15.10.2026
---

# Security model

!!! warning "Draft — pilot feature"
    Private Networks is in a limited pilot and this page is a work in progress.

## Isolation between tenants

Each private network is carried on its own isolated overlay. Packets are routed
on the pair *(network identity, private IP)*, not on Ethernet addresses, and
the network identity is assigned by Verda's control plane, it is not derived
from anything the guest sends.

Consequences:

- Two customers can use the same private ranges (`10.0.0.0/24` in both) without
  seeing each other. The addresses are only meaningful within a network.
- An instance cannot reach another customer's instance by guessing its private
  address.

## Access control

Private network, subnet, and route changes require a project role of
**developer** or above. Read access is available to any project member.
Everything is scoped to a single project, networks are never shared between
projects.