Kalitka Puts a Human Decision in Front of Sensitive Access

Field notes

Kalitka preserves an application's existing login while inserting a separate approval gate in front of it. The documented request records the requester, target resource, source address, and country, then issues a grant tied to that request; reverse proxies pass traffic only while the grant remains approved and unexpired. Telegram, email, and a web control plane provide approval channels. SSH access uses PAM and is explicitly labeled experimental.