Field notes
Why one application is often enough
Most support and operations work does not require a route into an entire network. It requires accountable use of one named web application for a limited time.
The authority should match the task
A Grafana review needs Grafana, not every RFC1918 address. Gatehouse turns that distinction into explicit service and method policy.
Outbound changes the deployment conversation
The connector initiates the tunnel, so private firewalls do not need an inbound forwarding rule.
Audit the decision, not the private content
Useful evidence is who, what, when, which policy, and why a request was accepted or denied. Response bodies remain private.