Worker Authorization

Workers must be authorized before they can join a broker's subnet. Authorization is handled by the broker using the admin-subnet plugin and tl-admin CLI.

Authorization Flow

The worker sends its public key to the broker when starting up. The broker must explicitly approve the worker using:

Once authorized, the worker can serve plugin requests on behalf of the broker.

Workers cannot:

• Authorize themselves
• Participate without approval
• Receive credit or run jobs without broker consent

Revocation

If a worker is compromised or misbehaving, the broker can revoke access using:

This immediately removes the worker from the subnet.