Smallstep Enterprise Relay is a Zero Trust Network Access (ZTNA) solution built on the MASQUE protocol standard (RFC 9298). It functions as a transparent network relay — distinct from traditional VPNs — using mutual TLS (mTLS) and hardware-bound device certificates to control access to both internal networks and SaaS applications. Access decisions are based on device identity rather than user credentials or sessions. Devices must present a valid, hardware-attested certificate to gain access; otherwise, they are blocked automatically. Authentication occurs silently in the background with no user-facing prompts, login screens, or browser extensions required. Traffic routing is controlled through configurable match/exclude domain rules, and access to target applications is enforced via IP allow lists and mutual TLS. The relay provides dedicated outbound egress IPs, enabling IP-based allow listing on SaaS platforms and internal services. Platform support includes: - Apple devices (iOS 17+, iPadOS 17+, macOS 14+, tvOS 17+) via the native Managed Relay MDM payload - Windows and Linux via the Smallstep agent The product extends ZTNA coverage beyond browser-based access to include CLI tools, SSH, APIs, AI-initiated workflows (MCP clients), and other non-browser applications. It can be deployed in cloud or on-premises environments, including air-gapped and hybrid configurations.