diff --git a/.github/k8s/sam-box-canary-template.yaml b/.github/k8s/sam-box-canary-template.yaml
index f0c5af04..72187570 100644
--- a/.github/k8s/sam-box-canary-template.yaml
+++ b/.github/k8s/sam-box-canary-template.yaml
@@ -16,6 +16,12 @@ data:
       kind: Bearer
       value: real-upstream-secret-123
 ---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: sam-box-sa
+  namespace: sam-canary-${ENV_NAME}
+---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -31,11 +37,11 @@ spec:
       labels:
         app: box-canary-${ENV_NAME}
     spec:
-      serviceAccountName: sam-node-sa
+      serviceAccountName: sam-box-sa
       initContainers:
       - name: init-nano-init
         image: ghcr.io/google/sam-nano-init:${IMAGE_TAG}
-        command: ["cp", "/nano-init", "/shared-bin/nano-init"]
+        command: ["/nano-init", "copy", "/shared-bin/nano-init"]
         volumeMounts:
         - name: shared-bin
           mountPath: /shared-bin
@@ -44,6 +50,7 @@ spec:
         image: alpine/curl:8.12.1
         command:
           - "/shared-bin/nano-init"
+          - "run"
           - "/var/run/sam/sam-box.sock"
           - "sh"
           - "-c"
diff --git a/.github/k8s/sam-control-plane-template.yaml b/.github/k8s/sam-control-plane-template.yaml
index b8a6c8f2..cce2db6b 100644
--- a/.github/k8s/sam-control-plane-template.yaml
+++ b/.github/k8s/sam-control-plane-template.yaml
@@ -153,6 +153,8 @@ data:
     bindings:
       - members: ["user:system:serviceaccount:sam-canary-${ENV_NAME}:sam-node-sa"]
         role: "sam-canary"
+      - members: ["user:system:serviceaccount:sam-canary-${ENV_NAME}:sam-box-sa"]
+        role: "sam:role:sambox"
       - members: ["group:routers", "user:system:serviceaccount:${NAMESPACE}:sam-router-sa"]
         role: "sam:role:router"
       - members: ["sam:system:authenticated"]
@@ -163,6 +165,11 @@ data:
           - "*"
         allowed_targets:
           - "*"
+      "sam:role:sambox":
+        allowed_services:
+          - "*"
+        allowed_targets:
+          - "*"
       "sam:role:router":
         allowed_services:
           - "*"
diff --git a/api/datalog.go b/api/datalog.go
index 1f422de3..47322f78 100644
--- a/api/datalog.go
+++ b/api/datalog.go
@@ -94,6 +94,7 @@ const (
 	// Standard role values
 	RoleRouter = "sam:role:router"
 	RoleNode   = "sam:role:node"
+	RoleSamBox = "sam:role:sambox"
 
 	// FactUser defines the subject (username/userID) claim extracted from the OIDC token.
 	// Contains: biscuit.String(username)
diff --git a/api/sam.pb.go b/api/sam.pb.go
index 6cad9686..4e7dc300 100644
--- a/api/sam.pb.go
+++ b/api/sam.pb.go
@@ -375,6 +375,7 @@ type EnrollRequest struct {
 	Jwt           string                 `protobuf:"bytes,1,opt,name=jwt,proto3" json:"jwt,omitempty"`
 	PeerId        string                 `protobuf:"bytes,2,opt,name=peer_id,json=peerId,proto3" json:"peer_id,omitempty"`
 	PublicKey     []byte                 `protobuf:"bytes,3,opt,name=public_key,json=publicKey,proto3" json:"public_key,omitempty"`
+	RequestedRole string                 `protobuf:"bytes,4,opt,name=requested_role,json=requestedRole,proto3" json:"requested_role,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -430,6 +431,13 @@ func (x *EnrollRequest) GetPublicKey() []byte {
 	return nil
 }
 
+func (x *EnrollRequest) GetRequestedRole() string {
+	if x != nil {
+		return x.RequestedRole
+	}
+	return ""
+}
+
 type EnrollResponse struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	BiscuitToken  []byte                 `protobuf:"bytes,1,opt,name=biscuit_token,json=biscuitToken,proto3" json:"biscuit_token,omitempty"`
@@ -506,18 +514,63 @@ func (x *EnrollResponse) GetExpiration() int64 {
 	return 0
 }
 
+type EnrollmentStatusRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	PeerId        string                 `protobuf:"bytes,1,opt,name=peer_id,json=peerId,proto3" json:"peer_id,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *EnrollmentStatusRequest) Reset() {
+	*x = EnrollmentStatusRequest{}
+	mi := &file_api_sam_proto_msgTypes[5]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *EnrollmentStatusRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*EnrollmentStatusRequest) ProtoMessage() {}
+
+func (x *EnrollmentStatusRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_api_sam_proto_msgTypes[5]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use EnrollmentStatusRequest.ProtoReflect.Descriptor instead.
+func (*EnrollmentStatusRequest) Descriptor() ([]byte, []int) {
+	return file_api_sam_proto_rawDescGZIP(), []int{5}
+}
+
+func (x *EnrollmentStatusRequest) GetPeerId() string {
+	if x != nil {
+		return x.PeerId
+	}
+	return ""
+}
+
 type BootstrapEnrollRequest struct {
 	state          protoimpl.MessageState `protogen:"open.v1"`
 	BootstrapToken string                 `protobuf:"bytes,1,opt,name=bootstrap_token,json=bootstrapToken,proto3" json:"bootstrap_token,omitempty"`
 	PeerId         string                 `protobuf:"bytes,2,opt,name=peer_id,json=peerId,proto3" json:"peer_id,omitempty"`
 	PublicKey      []byte                 `protobuf:"bytes,3,opt,name=public_key,json=publicKey,proto3" json:"public_key,omitempty"`
+	RequestedRole  string                 `protobuf:"bytes,4,opt,name=requested_role,json=requestedRole,proto3" json:"requested_role,omitempty"`
 	unknownFields  protoimpl.UnknownFields
 	sizeCache      protoimpl.SizeCache
 }
 
 func (x *BootstrapEnrollRequest) Reset() {
 	*x = BootstrapEnrollRequest{}
-	mi := &file_api_sam_proto_msgTypes[5]
+	mi := &file_api_sam_proto_msgTypes[6]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -529,7 +582,7 @@ func (x *BootstrapEnrollRequest) String() string {
 func (*BootstrapEnrollRequest) ProtoMessage() {}
 
 func (x *BootstrapEnrollRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_api_sam_proto_msgTypes[5]
+	mi := &file_api_sam_proto_msgTypes[6]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -542,7 +595,7 @@ func (x *BootstrapEnrollRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use BootstrapEnrollRequest.ProtoReflect.Descriptor instead.
 func (*BootstrapEnrollRequest) Descriptor() ([]byte, []int) {
-	return file_api_sam_proto_rawDescGZIP(), []int{5}
+	return file_api_sam_proto_rawDescGZIP(), []int{6}
 }
 
 func (x *BootstrapEnrollRequest) GetBootstrapToken() string {
@@ -566,6 +619,13 @@ func (x *BootstrapEnrollRequest) GetPublicKey() []byte {
 	return nil
 }
 
+func (x *BootstrapEnrollRequest) GetRequestedRole() string {
+	if x != nil {
+		return x.RequestedRole
+	}
+	return ""
+}
+
 type BootstrapEnrollResponse struct {
 	state               protoimpl.MessageState `protogen:"open.v1"`
 	Status              EnrollmentStatus       `protobuf:"varint,1,opt,name=status,proto3,enum=sam.v1.EnrollmentStatus" json:"status,omitempty"`
@@ -581,7 +641,7 @@ type BootstrapEnrollResponse struct {
 
 func (x *BootstrapEnrollResponse) Reset() {
 	*x = BootstrapEnrollResponse{}
-	mi := &file_api_sam_proto_msgTypes[6]
+	mi := &file_api_sam_proto_msgTypes[7]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -593,7 +653,7 @@ func (x *BootstrapEnrollResponse) String() string {
 func (*BootstrapEnrollResponse) ProtoMessage() {}
 
 func (x *BootstrapEnrollResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_api_sam_proto_msgTypes[6]
+	mi := &file_api_sam_proto_msgTypes[7]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -606,7 +666,7 @@ func (x *BootstrapEnrollResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use BootstrapEnrollResponse.ProtoReflect.Descriptor instead.
 func (*BootstrapEnrollResponse) Descriptor() ([]byte, []int) {
-	return file_api_sam_proto_rawDescGZIP(), []int{6}
+	return file_api_sam_proto_rawDescGZIP(), []int{7}
 }
 
 func (x *BootstrapEnrollResponse) GetStatus() EnrollmentStatus {
@@ -658,50 +718,6 @@ func (x *BootstrapEnrollResponse) GetExpiration() int64 {
 	return 0
 }
 
-type EnrollmentStatusRequest struct {
-	state         protoimpl.MessageState `protogen:"open.v1"`
-	PeerId        string                 `protobuf:"bytes,1,opt,name=peer_id,json=peerId,proto3" json:"peer_id,omitempty"`
-	unknownFields protoimpl.UnknownFields
-	sizeCache     protoimpl.SizeCache
-}
-
-func (x *EnrollmentStatusRequest) Reset() {
-	*x = EnrollmentStatusRequest{}
-	mi := &file_api_sam_proto_msgTypes[7]
-	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-	ms.StoreMessageInfo(mi)
-}
-
-func (x *EnrollmentStatusRequest) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*EnrollmentStatusRequest) ProtoMessage() {}
-
-func (x *EnrollmentStatusRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_api_sam_proto_msgTypes[7]
-	if x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use EnrollmentStatusRequest.ProtoReflect.Descriptor instead.
-func (*EnrollmentStatusRequest) Descriptor() ([]byte, []int) {
-	return file_api_sam_proto_rawDescGZIP(), []int{7}
-}
-
-func (x *EnrollmentStatusRequest) GetPeerId() string {
-	if x != nil {
-		return x.PeerId
-	}
-	return ""
-}
-
 type ServiceInfo struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	Type          ServiceType            `protobuf:"varint,1,opt,name=type,proto3,enum=sam.v1.ServiceType" json:"type,omitempty"`
@@ -1041,12 +1057,14 @@ func (x *HubInfoResponse) GetHubAddresses() []string {
 }
 
 type RouterLeaseRequest struct {
-	state         protoimpl.MessageState `protogen:"open.v1"`
-	PeerId        string                 `protobuf:"bytes,1,opt,name=peer_id,json=peerId,proto3" json:"peer_id,omitempty"`
-	Addresses     []string               `protobuf:"bytes,2,rep,name=addresses,proto3" json:"addresses,omitempty"`
-	Biscuit       []byte                 `protobuf:"bytes,3,opt,name=biscuit,proto3" json:"biscuit,omitempty"`
-	unknownFields protoimpl.UnknownFields
-	sizeCache     protoimpl.SizeCache
+	state          protoimpl.MessageState `protogen:"open.v1"`
+	PeerId         string                 `protobuf:"bytes,1,opt,name=peer_id,json=peerId,proto3" json:"peer_id,omitempty"`
+	Addresses      []string               `protobuf:"bytes,2,rep,name=addresses,proto3" json:"addresses,omitempty"`
+	Biscuit        []byte                 `protobuf:"bytes,3,opt,name=biscuit,proto3" json:"biscuit,omitempty"`
+	ConnectedPeers []string               `protobuf:"bytes,4,rep,name=connected_peers,json=connectedPeers,proto3" json:"connected_peers,omitempty"`
+	DhtSize        int32                  `protobuf:"varint,5,opt,name=dht_size,json=dhtSize,proto3" json:"dht_size,omitempty"`
+	unknownFields  protoimpl.UnknownFields
+	sizeCache      protoimpl.SizeCache
 }
 
 func (x *RouterLeaseRequest) Reset() {
@@ -1100,6 +1118,20 @@ func (x *RouterLeaseRequest) GetBiscuit() []byte {
 	return nil
 }
 
+func (x *RouterLeaseRequest) GetConnectedPeers() []string {
+	if x != nil {
+		return x.ConnectedPeers
+	}
+	return nil
+}
+
+func (x *RouterLeaseRequest) GetDhtSize() int32 {
+	if x != nil {
+		return x.DhtSize
+	}
+	return 0
+}
+
 type RouterLeaseResponse struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	Success       bool                   `protobuf:"varint,1,opt,name=success,proto3" json:"success,omitempty"`
@@ -1609,12 +1641,13 @@ const file_api_sam_proto_rawDesc = "" +
 	"\x04Type\x12\n" +
 	"\n" +
 	"\x06BANNED\x10\x00\x12\x10\n" +
-	"\fKEY_ROTATION\x10\x01\"Y\n" +
+	"\fKEY_ROTATION\x10\x01\"\x80\x01\n" +
 	"\rEnrollRequest\x12\x10\n" +
 	"\x03jwt\x18\x01 \x01(\tR\x03jwt\x12\x17\n" +
 	"\apeer_id\x18\x02 \x01(\tR\x06peerId\x12\x1d\n" +
 	"\n" +
-	"public_key\x18\x03 \x01(\fR\tpublicKey\"\xc5\x01\n" +
+	"public_key\x18\x03 \x01(\fR\tpublicKey\x12%\n" +
+	"\x0erequested_role\x18\x04 \x01(\tR\rrequestedRole\"\xc5\x01\n" +
 	"\x0eEnrollResponse\x12#\n" +
 	"\rbiscuit_token\x18\x01 \x01(\fR\fbiscuitToken\x12#\n" +
 	"\rerror_message\x18\x02 \x01(\tR\ferrorMessage\x12$\n" +
@@ -1622,12 +1655,15 @@ const file_api_sam_proto_rawDesc = "" +
 	"\rhub_addresses\x18\x04 \x03(\tR\fhubAddresses\x12\x1e\n" +
 	"\n" +
 	"expiration\x18\x05 \x01(\x03R\n" +
-	"expiration\"y\n" +
+	"expiration\"2\n" +
+	"\x17EnrollmentStatusRequest\x12\x17\n" +
+	"\apeer_id\x18\x01 \x01(\tR\x06peerId\"\xa0\x01\n" +
 	"\x16BootstrapEnrollRequest\x12'\n" +
 	"\x0fbootstrap_token\x18\x01 \x01(\tR\x0ebootstrapToken\x12\x17\n" +
 	"\apeer_id\x18\x02 \x01(\tR\x06peerId\x12\x1d\n" +
 	"\n" +
-	"public_key\x18\x03 \x01(\fR\tpublicKey\"\xb4\x02\n" +
+	"public_key\x18\x03 \x01(\fR\tpublicKey\x12%\n" +
+	"\x0erequested_role\x18\x04 \x01(\tR\rrequestedRole\"\xb4\x02\n" +
 	"\x17BootstrapEnrollResponse\x120\n" +
 	"\x06status\x18\x01 \x01(\x0e2\x18.sam.v1.EnrollmentStatusR\x06status\x12#\n" +
 	"\rbiscuit_token\x18\x02 \x01(\fR\fbiscuitToken\x122\n" +
@@ -1637,9 +1673,7 @@ const file_api_sam_proto_rawDesc = "" +
 	"\rhub_addresses\x18\x06 \x03(\tR\fhubAddresses\x12\x1e\n" +
 	"\n" +
 	"expiration\x18\a \x01(\x03R\n" +
-	"expiration\"2\n" +
-	"\x17EnrollmentStatusRequest\x12\x17\n" +
-	"\apeer_id\x18\x01 \x01(\tR\x06peerId\"l\n" +
+	"expiration\"l\n" +
 	"\vServiceInfo\x12'\n" +
 	"\x04type\x18\x01 \x01(\x0e2\x13.sam.v1.ServiceTypeR\x04type\x12\x12\n" +
 	"\x04name\x18\x02 \x01(\tR\x04name\x12 \n" +
@@ -1666,11 +1700,13 @@ const file_api_sam_proto_rawDesc = "" +
 	"oidcIssuer\x12\x1b\n" +
 	"\tclient_id\x18\x02 \x01(\tR\bclientId\x12\x1a\n" +
 	"\baudience\x18\x03 \x01(\tR\baudience\x12#\n" +
-	"\rhub_addresses\x18\x04 \x03(\tR\fhubAddresses\"e\n" +
+	"\rhub_addresses\x18\x04 \x03(\tR\fhubAddresses\"\xa9\x01\n" +
 	"\x12RouterLeaseRequest\x12\x17\n" +
 	"\apeer_id\x18\x01 \x01(\tR\x06peerId\x12\x1c\n" +
 	"\taddresses\x18\x02 \x03(\tR\taddresses\x12\x18\n" +
-	"\abiscuit\x18\x03 \x01(\fR\abiscuit\"d\n" +
+	"\abiscuit\x18\x03 \x01(\fR\abiscuit\x12'\n" +
+	"\x0fconnected_peers\x18\x04 \x03(\tR\x0econnectedPeers\x12\x19\n" +
+	"\bdht_size\x18\x05 \x01(\x05R\adhtSize\"d\n" +
 	"\x13RouterLeaseResponse\x12\x18\n" +
 	"\asuccess\x18\x01 \x01(\bR\asuccess\x12\x14\n" +
 	"\x05error\x18\x02 \x01(\tR\x05error\x12\x1d\n" +
@@ -1733,9 +1769,9 @@ var file_api_sam_proto_goTypes = []any{
 	(*MeshEvent)(nil),                  // 5: sam.v1.MeshEvent
 	(*EnrollRequest)(nil),              // 6: sam.v1.EnrollRequest
 	(*EnrollResponse)(nil),             // 7: sam.v1.EnrollResponse
-	(*BootstrapEnrollRequest)(nil),     // 8: sam.v1.BootstrapEnrollRequest
-	(*BootstrapEnrollResponse)(nil),    // 9: sam.v1.BootstrapEnrollResponse
-	(*EnrollmentStatusRequest)(nil),    // 10: sam.v1.EnrollmentStatusRequest
+	(*EnrollmentStatusRequest)(nil),    // 8: sam.v1.EnrollmentStatusRequest
+	(*BootstrapEnrollRequest)(nil),     // 9: sam.v1.BootstrapEnrollRequest
+	(*BootstrapEnrollResponse)(nil),    // 10: sam.v1.BootstrapEnrollResponse
 	(*ServiceInfo)(nil),                // 11: sam.v1.ServiceInfo
 	(*CommandBackend)(nil),             // 12: sam.v1.CommandBackend
 	(*RegisterServiceRequest)(nil),     // 13: sam.v1.RegisterServiceRequest
diff --git a/api/sam.proto b/api/sam.proto
index b1940a21..9828c97f 100644
--- a/api/sam.proto
+++ b/api/sam.proto
@@ -47,6 +47,7 @@ message EnrollRequest {
   string jwt = 1;
   string peer_id = 2;
   bytes public_key = 3;
+  string requested_role = 4;
 }
 
 message EnrollResponse {
@@ -57,6 +58,10 @@ message EnrollResponse {
   int64 expiration = 5;
 }
 
+message EnrollmentStatusRequest {
+  string peer_id = 1;
+}
+
 enum EnrollmentStatus {
   ENROLLMENT_STATUS_UNSPECIFIED = 0;
   ENROLLMENT_STATUS_PENDING = 1;
@@ -68,6 +73,7 @@ message BootstrapEnrollRequest {
   string bootstrap_token = 1;
   string peer_id = 2;
   bytes public_key = 3;
+  string requested_role = 4;
 }
 
 message BootstrapEnrollResponse {
@@ -80,9 +86,7 @@ message BootstrapEnrollResponse {
   int64 expiration = 7;             // Populated only if APPROVED
 }
 
-message EnrollmentStatusRequest {
-  string peer_id = 1;
-}
+
 
 enum ServiceType {
   SERVICE_TYPE_UNSPECIFIED = 0;
@@ -127,6 +131,8 @@ message RouterLeaseRequest {
   string peer_id = 1;
   repeated string addresses = 2;
   bytes biscuit = 3;
+  repeated string connected_peers = 4;
+  int32 dht_size = 5;
 }
 
 message RouterLeaseResponse {
diff --git a/cmd/nano-init/main.go b/cmd/nano-init/main.go
index c8be4578..4a003c77 100644
--- a/cmd/nano-init/main.go
+++ b/cmd/nano-init/main.go
@@ -35,13 +35,48 @@ import (
 )
 
 func main() {
-	if len(os.Args) < 3 {
-		log.Fatalf("Usage: %s <uds-path> <cmd> [args...]", os.Args[0])
+	if len(os.Args) < 2 {
+		printUsageAndExit()
 	}
-	udsPath := os.Args[1]
-	cmdName := os.Args[2]
-	cmdArgs := os.Args[3:]
 
+	subCmd := os.Args[1]
+	switch subCmd {
+	case "copy":
+		if len(os.Args) != 3 {
+			log.Fatalf("Usage: %s copy <dest>", os.Args[0])
+		}
+		src, err := os.Executable()
+		if err != nil {
+			src = "/nano-init"
+		}
+		dest := os.Args[2]
+		log.Printf("Copying %s to %s...", src, dest)
+		if err := copyFile(src, dest); err != nil {
+			log.Fatalf("Failed to copy binary: %v", err)
+		}
+		log.Println("Copy complete.")
+		return
+
+	case "run":
+		if len(os.Args) < 4 {
+			log.Fatalf("Usage: %s run <uds-path> <cmd> [args...]", os.Args[0])
+		}
+		udsPath := os.Args[2]
+		cmdName := os.Args[3]
+		cmdArgs := os.Args[4:]
+
+		runProxy(udsPath, cmdName, cmdArgs)
+
+	default:
+		printUsageAndExit()
+	}
+}
+
+func printUsageAndExit() {
+	log.Fatalf("Usage:\n  %s copy <dest>\n  %s run <uds-path> <cmd> [args...]", os.Args[0], os.Args[0])
+}
+
+func runProxy(udsPath, cmdName string, cmdArgs []string) {
 	ctx, cancel := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM, syscall.SIGQUIT)
 	defer cancel()
 
@@ -449,3 +484,20 @@ func buildAgentEnv(assignedPort int, caPath string, interceptorPath string) []st
 
 	return result
 }
+
+func copyFile(src, dest string) error {
+	in, err := os.Open(src)
+	if err != nil {
+		return err
+	}
+	defer in.Close() //nolint:errcheck
+	out, err := os.OpenFile(dest, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0755)
+	if err != nil {
+		return err
+	}
+	if _, err = io.Copy(out, in); err != nil {
+		out.Close() //nolint:errcheck
+		return err
+	}
+	return out.Close()
+}
diff --git a/cmd/nano-init/main_test.go b/cmd/nano-init/main_test.go
index ada75405..a719d0be 100644
--- a/cmd/nano-init/main_test.go
+++ b/cmd/nano-init/main_test.go
@@ -292,6 +292,40 @@ func TestBuildAgentEnv(t *testing.T) {
 	}
 }
 
+func TestCopyFile(t *testing.T) {
+	tempDir := t.TempDir()
+	src := filepath.Join(tempDir, "source-file")
+	dest := filepath.Join(tempDir, "dest-file")
+
+	content := []byte("hello copy world")
+	if err := os.WriteFile(src, content, 0755); err != nil {
+		t.Fatalf("Failed to write source file: %v", err)
+	}
+
+	if err := copyFile(src, dest); err != nil {
+		t.Fatalf("copyFile failed: %v", err)
+	}
+
+	data, err := os.ReadFile(dest)
+	if err != nil {
+		t.Fatalf("Failed to read dest file: %v", err)
+	}
+
+	if string(data) != string(content) {
+		t.Errorf("Expected content %q, got %q", string(content), string(data))
+	}
+
+	fi, err := os.Stat(dest)
+	if err != nil {
+		t.Fatalf("Stat dest failed: %v", err)
+	}
+
+	expectedMode := os.FileMode(0755)
+	if fi.Mode().Perm() != expectedMode {
+		t.Errorf("Expected permissions %v, got %v", expectedMode, fi.Mode().Perm())
+	}
+}
+
 func TestBootstrapInterceptor(t *testing.T) {
 	tempDir := t.TempDir()
 	udsPath := filepath.Join(tempDir, "mock-sam-box-interceptor.sock")
diff --git a/cmd/sam-box/main.go b/cmd/sam-box/main.go
index 523c52e6..7e0f92df 100644
--- a/cmd/sam-box/main.go
+++ b/cmd/sam-box/main.go
@@ -219,6 +219,7 @@ func main() {
 					AutoRelayBootDelay:   autoRelayBootDelayFlag,
 					AutoRelayBackoff:     autoRelayBackoffFlag,
 					HubConnectTimeout:    hubConnectTimeoutFlag,
+					RequiredRole:         api.RoleSamBox,
 				})
 				if err != nil {
 					logger.Fatalf("Failed to initialize mesh node: %v", err)
@@ -272,6 +273,7 @@ func main() {
 					AutoRelayBootDelay:   autoRelayBootDelayFlag,
 					AutoRelayBackoff:     autoRelayBackoffFlag,
 					HubConnectTimeout:    hubConnectTimeoutFlag,
+					RequiredRole:         api.RoleSamBox,
 				})
 				if err != nil {
 					logger.Fatalf("Failed to initialize node for enrollment: %v", err)
@@ -447,6 +449,7 @@ func main() {
 				AutoRelayBootDelay:   0 * time.Second,
 				AutoRelayBackoff:     3 * time.Second,
 				HubConnectTimeout:    hubConnectTimeoutFlag,
+				RequiredRole:         api.RoleSamBox,
 			})
 			if err != nil {
 				logger.Fatalf("Failed to initialize node for enrollment: %v", err)
diff --git a/cmd/sam-node/main.go b/cmd/sam-node/main.go
index 1dd78e4b..7bb58369 100644
--- a/cmd/sam-node/main.go
+++ b/cmd/sam-node/main.go
@@ -227,6 +227,7 @@ func main() {
 					AutoRelayBootDelay:   autoRelayBootDelayFlag,
 					AutoRelayBackoff:     autoRelayBackoffFlag,
 					HubConnectTimeout:    hubConnectTimeoutFlag,
+					RequiredRole:         api.RoleNode,
 					DHTProviderAddrTTL:   dhtProviderAddrTTLFlag,
 					DHTMaxRecordAge:      dhtMaxRecordAgeFlag,
 					DHTLookupLimit:       dhtLookupLimitFlag,
@@ -290,6 +291,7 @@ func main() {
 					AutoRelayBootDelay:   autoRelayBootDelayFlag,
 					AutoRelayBackoff:     autoRelayBackoffFlag,
 					HubConnectTimeout:    hubConnectTimeoutFlag,
+					RequiredRole:         api.RoleNode,
 					DHTProviderAddrTTL:   dhtProviderAddrTTLFlag,
 					DHTMaxRecordAge:      dhtMaxRecordAgeFlag,
 					DHTLookupLimit:       dhtLookupLimitFlag,
@@ -350,6 +352,7 @@ func main() {
 					AutoRelayBootDelay:   autoRelayBootDelayFlag,
 					AutoRelayBackoff:     autoRelayBackoffFlag,
 					HubConnectTimeout:    hubConnectTimeoutFlag,
+					RequiredRole:         api.RoleNode,
 				})
 				if err != nil {
 					logger.Fatalf("Failed to initialize node after enrollment: %v", err)
@@ -508,6 +511,7 @@ func main() {
 				AutoRelayBootDelay:   0 * time.Second,
 				AutoRelayBackoff:     3 * time.Second,
 				HubConnectTimeout:    hubConnectTimeoutFlag,
+				RequiredRole:         api.RoleNode,
 			})
 			if err != nil {
 				logger.Fatalf("Failed to initialize node for enrollment: %v", err)
diff --git a/development/kind/10-control-plane.yaml b/development/kind/10-control-plane.yaml
index 1a849d2b..65533a42 100644
--- a/development/kind/10-control-plane.yaml
+++ b/development/kind/10-control-plane.yaml
@@ -139,6 +139,8 @@ data:
         role: "sam-admin"
       - members: ["user:system:serviceaccount:${NAMESPACE}:local-node-sa"]
         role: "sam-admin"
+      - members: ["user:system:serviceaccount:${NAMESPACE}:sam-box-sa"]
+        role: "sam:role:sambox"
       - members: ["group:routers", "user:system:serviceaccount:${NAMESPACE}:sam-router-sa"]
         role: "sam:role:router"
     roles:
@@ -147,6 +149,11 @@ data:
           - "*"
         allowed_targets:
           - "*"
+      "sam:role:sambox":
+        allowed_services:
+          - "*"
+        allowed_targets:
+          - "*"
       "sam:role:router":
         allowed_services:
           - "*"
diff --git a/internal/controlplane/server.go b/internal/controlplane/server.go
index 59b138c8..b395e8d3 100644
--- a/internal/controlplane/server.go
+++ b/internal/controlplane/server.go
@@ -148,6 +148,8 @@ func (s *Server) Start() error {
 	mux.HandleFunc("/admin/enrollments", s.HandleAdminEnrollments)
 	mux.HandleFunc("/admin/enrollments/", s.HandleAdminEnrollmentAction)
 	mux.HandleFunc("/admin/revoke", s.HandleAdminRevoke)
+	mux.HandleFunc("/admin/status", s.HandleAdminStatus)
+	mux.HandleFunc("/admin/", s.HandleAdminUI)
 
 	s.httpServer = &http.Server{
 		Handler: mux,
@@ -344,26 +346,23 @@ func (s *Server) HandleRegister(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	if req.RequestedRole == "" {
+		http.Error(w, "requested_role must be specified", http.StatusBadRequest)
+		return
+	}
+
 	// Mint token
 	biscuitExpiry := time.Now().Add(api.BiscuitTokenTTL)
-	biscuitData, resolvedRoles, err := identity.MintBiscuitToken(privKey, claims, token, pID, policy, biscuitExpiry)
+	biscuitData, _, err := identity.MintBiscuitToken(privKey, claims, token, pID, policy, biscuitExpiry, req.RequestedRole)
 	if err != nil {
 		logger.Errorw("Biscuit minting failed", "peer_id", req.PeerId, "error", err)
-		http.Error(w, "Failed to mint biscuit: "+err.Error(), http.StatusInternalServerError)
+		http.Error(w, "Failed to mint biscuit: "+err.Error(), http.StatusForbidden)
 		return
 	}
 
 	// Session TTL is 90 days for OIDC interactive enrollment
 	sessionExpiresAt := time.Now().Add(api.OIDCSessionTTL)
-
-	// Determine primary role from resolved roles
-	primaryRole := api.RoleNode
-	for _, r := range resolvedRoles {
-		if strings.HasPrefix(r, "sam:role:") {
-			primaryRole = r
-			break
-		}
-	}
+	primaryRole := req.RequestedRole
 
 	claimsBytes, err := json.Marshal(claims)
 	if err != nil {
@@ -540,7 +539,7 @@ func (s *Server) HandleRefresh(w http.ResponseWriter, r *http.Request) {
 			http.Error(w, "Internal server error", http.StatusInternalServerError)
 			return
 		}
-		bBytes, _, err := identity.MintBiscuitToken(privKey, claims, nil, pID, policy, biscuitExpiry)
+		bBytes, _, err := identity.MintBiscuitToken(privKey, claims, nil, pID, policy, biscuitExpiry, nodeRecord.Role)
 		if err != nil {
 			logger.Errorf("Failed to mint refreshed token for node %s: %v", nodeRecord.PeerID, err)
 			http.Error(w, "Internal server error", http.StatusInternalServerError)
@@ -658,7 +657,7 @@ func (s *Server) HandleRouterLease(w http.ResponseWriter, r *http.Request) {
 	}
 
 	// Verify Biscuit and enforce expected remote peer id
-	b, err := identity.VerifyBiscuit(req.Biscuit, pID, cpPubKeys, s.config.BiscuitTimeout)
+	b, verifyingKey, err := identity.VerifyBiscuitAndGetKey(req.Biscuit, pID, cpPubKeys, s.config.BiscuitTimeout)
 	if err != nil {
 		logger.Warnf("Router %s failed biscuit verification: %v", req.PeerId, err)
 		http.Error(w, "Biscuit verification failed: "+err.Error(), http.StatusUnauthorized)
@@ -666,7 +665,7 @@ func (s *Server) HandleRouterLease(w http.ResponseWriter, r *http.Request) {
 	}
 
 	// Enforce role("router") or role("bootstrap") inside the biscuit
-	authorizer, err := b.Authorizer(cpPubKeys[0]) // First public key is generally the current one, but biscuit-go handles matches internally
+	authorizer, err := b.Authorizer(verifyingKey)
 	if err != nil {
 		http.Error(w, "Internal authorizer error", http.StatusInternalServerError)
 		return
@@ -682,7 +681,7 @@ func (s *Server) HandleRouterLease(w http.ResponseWriter, r *http.Request) {
 	authorizer.AddPolicy(api.AllowIfTruePolicy)
 
 	if err := authorizer.Authorize(); err != nil {
-		logger.Warnf("Router %s lacks router role in its biscuit: %v", req.PeerId, err)
+		logger.Warnf("Router %s lacks router role in its biscuit: %v\nWorld state:\n%s", req.PeerId, err, authorizer.PrintWorld())
 		http.Error(w, "Unauthorized: entity is not a router", http.StatusForbidden)
 		return
 	}
@@ -690,10 +689,12 @@ func (s *Server) HandleRouterLease(w http.ResponseWriter, r *http.Request) {
 	// Expose lease renewal
 	expiresAt := time.Now().Add(s.config.LeaseDuration)
 	lease := &storage.RouterLease{
-		PeerID:      req.PeerId,
-		Addresses:   req.Addresses,
-		LastRenewal: time.Now(),
-		ExpiresAt:   expiresAt,
+		PeerID:         req.PeerId,
+		Addresses:      req.Addresses,
+		LastRenewal:    time.Now(),
+		ExpiresAt:      expiresAt,
+		ConnectedPeers: req.ConnectedPeers,
+		DHTSize:        int(req.DhtSize),
 	}
 
 	if err := s.store.UpsertRouterLease(r.Context(), lease); err != nil {
@@ -720,6 +721,9 @@ func (s *Server) HandleRouterLease(w http.ResponseWriter, r *http.Request) {
 
 // HandlePolicies HTTP GET/POST/PUT `/policies`
 func (s *Server) HandlePolicies(w http.ResponseWriter, r *http.Request) {
+	if !s.checkAdminAuth(w, r) {
+		return
+	}
 	// Simple HTTP admin methods for policies
 	switch r.Method {
 	case http.MethodGet:
@@ -893,6 +897,17 @@ func (s *Server) HandleEnroll(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	if req.RequestedRole == "" {
+		s.writeEnrollError(w, api.EnrollmentStatus_ENROLLMENT_STATUS_REJECTED, "requested_role must be specified")
+		return
+	}
+
+	if req.RequestedRole != tokenRecord.Role {
+		logger.Warnw("Requested role does not match bootstrap token role", "peer_id", req.PeerId, "requested", req.RequestedRole, "token_role", tokenRecord.Role)
+		s.writeEnrollError(w, api.EnrollmentStatus_ENROLLMENT_STATUS_REJECTED, fmt.Sprintf("requested role %q does not match bootstrap token role %q", req.RequestedRole, tokenRecord.Role))
+		return
+	}
+
 	pID, err := peer.Decode(req.PeerId)
 	if err != nil {
 		http.Error(w, "Invalid Peer ID", http.StatusBadRequest)
@@ -1061,7 +1076,8 @@ func (s *Server) HandleEnrollStatus(w http.ResponseWriter, r *http.Request) {
 
 func (s *Server) checkAdminAuth(w http.ResponseWriter, r *http.Request) bool {
 	if s.config.AdminToken == "" {
-		return true
+		http.Error(w, "Unauthorized", http.StatusUnauthorized)
+		return false
 	}
 	authHeader := r.Header.Get("Authorization")
 	if !strings.HasPrefix(authHeader, "Bearer ") {
@@ -1069,7 +1085,7 @@ func (s *Server) checkAdminAuth(w http.ResponseWriter, r *http.Request) bool {
 		return false
 	}
 	token := strings.TrimPrefix(authHeader, "Bearer ")
-	if token != s.config.AdminToken {
+	if token == "" || token != s.config.AdminToken {
 		http.Error(w, "Unauthorized", http.StatusUnauthorized)
 		return false
 	}
diff --git a/internal/controlplane/server_test.go b/internal/controlplane/server_test.go
index 366d5ac7..caba7ed3 100644
--- a/internal/controlplane/server_test.go
+++ b/internal/controlplane/server_test.go
@@ -253,9 +253,10 @@ func TestNodeAndRouterRegistrationFlow(t *testing.T) {
 
 	nodePubKeyBytes, _ := crypto.MarshalPublicKey(privNode.GetPublic())
 	enrollNodeReq := &api.EnrollRequest{
-		Jwt:       nodeJWT,
-		PeerId:    nodePeer.String(),
-		PublicKey: nodePubKeyBytes,
+		Jwt:           nodeJWT,
+		PeerId:        nodePeer.String(),
+		PublicKey:     nodePubKeyBytes,
+		RequestedRole: api.RoleNode,
 	}
 	reqData, _ := proto.Marshal(enrollNodeReq)
 
@@ -295,9 +296,10 @@ func TestNodeAndRouterRegistrationFlow(t *testing.T) {
 
 	routerPubKeyBytes, _ := crypto.MarshalPublicKey(privRouter.GetPublic())
 	enrollRouterReq := &api.EnrollRequest{
-		Jwt:       routerJWT,
-		PeerId:    routerPeer.String(),
-		PublicKey: routerPubKeyBytes,
+		Jwt:           routerJWT,
+		PeerId:        routerPeer.String(),
+		PublicKey:     routerPubKeyBytes,
+		RequestedRole: api.RoleRouter,
 	}
 	reqData, _ = proto.Marshal(enrollRouterReq)
 
@@ -387,10 +389,36 @@ func TestPoliciesConfigurationREST(t *testing.T) {
 		_ = store.Close()
 	}()
 
+	srv.config.AdminToken = "super-secret-admin-token"
 	client := &http.Client{Timeout: 5 * time.Second}
 
-	// 1. Get policies (should return 404 since none exists)
-	resp, err := client.Get(baseURL + "/policies")
+	// 1. Get policies without token (should return 401)
+	req, _ := http.NewRequest(http.MethodGet, baseURL+"/policies", nil)
+	resp, err := client.Do(req)
+	if err != nil {
+		t.Fatalf("GET /policies failed: %v", err)
+	}
+	if resp.StatusCode != http.StatusUnauthorized {
+		t.Errorf("expected 401 for unauthenticated request, got %d", resp.StatusCode)
+	}
+	_ = resp.Body.Close()
+
+	// 2. Get policies with incorrect token (should return 401)
+	req, _ = http.NewRequest(http.MethodGet, baseURL+"/policies", nil)
+	req.Header.Set("Authorization", "Bearer wrong-token")
+	resp, err = client.Do(req)
+	if err != nil {
+		t.Fatalf("GET /policies failed: %v", err)
+	}
+	if resp.StatusCode != http.StatusUnauthorized {
+		t.Errorf("expected 401 for invalid token, got %d", resp.StatusCode)
+	}
+	_ = resp.Body.Close()
+
+	// 3. Get policies with correct token (should return 404 since none exists)
+	req, _ = http.NewRequest(http.MethodGet, baseURL+"/policies", nil)
+	req.Header.Set("Authorization", "Bearer super-secret-admin-token")
+	resp, err = client.Do(req)
 	if err != nil {
 		t.Fatalf("GET /policies failed: %v", err)
 	}
@@ -399,7 +427,7 @@ func TestPoliciesConfigurationREST(t *testing.T) {
 	}
 	_ = resp.Body.Close()
 
-	// 2. Put policies
+	// 4. Put policies (should succeed)
 	newPolicyYaml := `
 version: v1alpha1
 bindings:
@@ -414,7 +442,10 @@ roles:
 	updateReq := &api.PolicyConfigUpdateRequest{YamlContent: newPolicyYaml}
 	reqData, _ := proto.Marshal(updateReq)
 
-	resp, err = client.Post(baseURL+"/policies", "application/x-protobuf", bytes.NewReader(reqData))
+	req, _ = http.NewRequest(http.MethodPost, baseURL+"/policies", bytes.NewReader(reqData))
+	req.Header.Set("Content-Type", "application/x-protobuf")
+	req.Header.Set("Authorization", "Bearer super-secret-admin-token")
+	resp, err = client.Do(req)
 	if err != nil {
 		t.Fatalf("POST /policies failed: %v", err)
 	}
@@ -424,8 +455,10 @@ roles:
 	}
 	_ = resp.Body.Close()
 
-	// 3. Get policies again (verify content)
-	resp, err = client.Get(baseURL + "/policies")
+	// 5. Get policies again with correct token (verify content)
+	req, _ = http.NewRequest(http.MethodGet, baseURL+"/policies", nil)
+	req.Header.Set("Authorization", "Bearer super-secret-admin-token")
+	resp, err = client.Do(req)
 	if err != nil {
 		t.Fatalf("GET /policies failed: %v", err)
 	}
@@ -504,6 +537,7 @@ func TestEnrollmentWorkflow(t *testing.T) {
 		BootstrapToken: tokenDetails.Token,
 		PeerId:         pID.String(),
 		PublicKey:      pubBytes,
+		RequestedRole:  api.RoleRouter,
 	}
 	enrollReqData, _ := proto.Marshal(enrollReq)
 
@@ -631,6 +665,7 @@ func TestEnrollmentWorkflow(t *testing.T) {
 		BootstrapToken: tokenDetails.Token, // use remaining usage
 		PeerId:         pID2.String(),
 		PublicKey:      pubBytes2,
+		RequestedRole:  api.RoleRouter,
 	}
 	enrollReqData2, _ := proto.Marshal(enrollReq2)
 
@@ -690,9 +725,10 @@ func TestTokenRefreshAndRevocation(t *testing.T) {
 
 	nodePubKeyBytes, _ := crypto.MarshalPublicKey(pubNode)
 	enrollNodeReq := &api.EnrollRequest{
-		Jwt:       nodeJWT,
-		PeerId:    nodePeer.String(),
-		PublicKey: nodePubKeyBytes,
+		Jwt:           nodeJWT,
+		PeerId:        nodePeer.String(),
+		PublicKey:     nodePubKeyBytes,
+		RequestedRole: api.RoleNode,
 	}
 	reqData, _ := proto.Marshal(enrollNodeReq)
 
@@ -827,9 +863,10 @@ func TestNodeProactiveTokenRefresh(t *testing.T) {
 	// Enroll via registration endpoint
 	nodePubKeyBytes, _ := crypto.MarshalPublicKey(pubNode)
 	enrollNodeReq := &api.EnrollRequest{
-		Jwt:       nodeJWT,
-		PeerId:    nodePeer.String(),
-		PublicKey: nodePubKeyBytes,
+		Jwt:           nodeJWT,
+		PeerId:        nodePeer.String(),
+		PublicKey:     nodePubKeyBytes,
+		RequestedRole: api.RoleNode,
 	}
 	reqData, _ := proto.Marshal(enrollNodeReq)
 
@@ -902,3 +939,81 @@ func TestNodeProactiveTokenRefresh(t *testing.T) {
 		t.Errorf("expected refreshed expiration %d to be after initial expiration %d", refreshedExpiration, enrollNodeResp.Expiration)
 	}
 }
+
+func TestAdminPanelAndUI(t *testing.T) {
+	issuer, _ := startCustomMockOIDC(t)
+	srv, store, baseURL := setupTestServer(t, issuer)
+	defer func() {
+		_ = srv.Close()
+		_ = store.Close()
+	}()
+
+	srv.config.AdminToken = "test-admin-pass"
+
+	client := &http.Client{Timeout: 5 * time.Second}
+
+	// 1. Query /admin/status without token -> should fail with 401
+	resp, err := client.Get(baseURL + "/admin/status")
+	if err != nil {
+		t.Fatalf("GET /admin/status failed: %v", err)
+	}
+	if resp.StatusCode != http.StatusUnauthorized {
+		t.Errorf("expected 401 status for unauthenticated status query, got: %d", resp.StatusCode)
+	}
+	_ = resp.Body.Close()
+
+	// 2. Query /admin/status with token -> should succeed
+	req, _ := http.NewRequest("GET", baseURL+"/admin/status", nil)
+	req.Header.Set("Authorization", "Bearer test-admin-pass")
+	resp, err = client.Do(req)
+	if err != nil {
+		t.Fatalf("GET /admin/status failed: %v", err)
+	}
+	if resp.StatusCode != http.StatusOK {
+		t.Errorf("expected 200 status for authenticated status query, got: %d", resp.StatusCode)
+	}
+
+	var statusData map[string]any
+	if err := json.NewDecoder(resp.Body).Decode(&statusData); err != nil {
+		t.Fatalf("failed to decode admin status response: %v", err)
+	}
+	_ = resp.Body.Close()
+
+	if _, ok := statusData["active_routers"]; !ok {
+		t.Error("status response missing active_routers")
+	}
+	if _, ok := statusData["enrolled_nodes"]; !ok {
+		t.Error("status response missing enrolled_nodes")
+	}
+	if _, ok := statusData["enrollment_requests"]; !ok {
+		t.Error("status response missing enrollment_requests")
+	}
+	if _, ok := statusData["bootstrap_tokens"]; !ok {
+		t.Error("status response missing bootstrap_tokens")
+	}
+
+	// 3. Query /admin/ UI page -> should succeed and serve the index.html without auth header
+	resp, err = client.Get(baseURL + "/admin/")
+	if err != nil {
+		t.Fatalf("GET /admin/ failed: %v", err)
+	}
+	if resp.StatusCode != http.StatusOK {
+		t.Errorf("expected 200 status for /admin/ UI page, got: %d", resp.StatusCode)
+	}
+	body, _ := io.ReadAll(resp.Body)
+	_ = resp.Body.Close()
+
+	if !strings.Contains(string(body), "<title>SAM Control Plane Admin</title>") {
+		t.Error("UI page does not contain expected HTML title")
+	}
+
+	// 4. Query /policies without token -> should fail with 401
+	resp, err = client.Get(baseURL + "/policies")
+	if err != nil {
+		t.Fatalf("GET /policies failed: %v", err)
+	}
+	if resp.StatusCode != http.StatusUnauthorized {
+		t.Errorf("expected 401 status for unauthenticated GET /policies, got: %d", resp.StatusCode)
+	}
+	_ = resp.Body.Close()
+}
diff --git a/internal/controlplane/ui.go b/internal/controlplane/ui.go
new file mode 100644
index 00000000..87e7fd7c
--- /dev/null
+++ b/internal/controlplane/ui.go
@@ -0,0 +1,1355 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package controlplane
+
+import (
+	"encoding/json"
+	"net/http"
+
+	"gopkg.in/yaml.v2"
+)
+
+// HandleAdminStatus returns a consolidated JSON state of the control plane.
+func (s *Server) HandleAdminStatus(w http.ResponseWriter, r *http.Request) {
+	if !s.checkAdminAuth(w, r) {
+		return
+	}
+
+	if r.Method != http.MethodGet {
+		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+
+	ctx := r.Context()
+
+	routers, err := s.store.GetActiveRouters(ctx)
+	if err != nil {
+		logger.Errorf("Failed to get active routers: %v", err)
+		http.Error(w, "Internal server error", http.StatusInternalServerError)
+		return
+	}
+
+	nodes, err := s.store.ListNodes(ctx)
+	if err != nil {
+		logger.Errorf("Failed to list nodes: %v", err)
+		http.Error(w, "Internal server error", http.StatusInternalServerError)
+		return
+	}
+
+	reqs, err := s.store.ListEnrollmentRequests(ctx)
+	if err != nil {
+		logger.Errorf("Failed to list enrollment requests: %v", err)
+		http.Error(w, "Internal server error", http.StatusInternalServerError)
+		return
+	}
+
+	tokens, err := s.store.ListBootstrapTokens(ctx)
+	if err != nil {
+		logger.Errorf("Failed to list bootstrap tokens: %v", err)
+		http.Error(w, "Internal server error", http.StatusInternalServerError)
+		return
+	}
+
+	var policyYAML string
+	policy, err := s.store.GetPolicy(ctx)
+	if err == nil {
+		yamlData, err := yaml.Marshal(policy)
+		if err == nil {
+			policyYAML = string(yamlData)
+		}
+	}
+
+	resp := map[string]any{
+		"active_routers":      routers,
+		"enrolled_nodes":      nodes,
+		"enrollment_requests": reqs,
+		"bootstrap_tokens":    tokens,
+		"policy_yaml":         policyYAML,
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(http.StatusOK)
+	_ = json.NewEncoder(w).Encode(resp)
+}
+
+// HandleAdminUI serves the dashboard single page web app.
+func (s *Server) HandleAdminUI(w http.ResponseWriter, r *http.Request) {
+	if r.URL.Path == "/admin" {
+		http.Redirect(w, r, "/admin/", http.StatusMovedPermanently)
+		return
+	}
+
+	w.Header().Set("Content-Type", "text/html; charset=utf-8")
+	w.WriteHeader(http.StatusOK)
+	_, _ = w.Write([]byte(adminHTML))
+}
+
+const adminHTML = `<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>SAM Control Plane Admin</title>
+    <link href="https://fonts.googleapis.com/css2?family=Inter:wght@300;400;500;600;700&display=swap" rel="stylesheet">
+    <style>
+        :root {
+            --bg-primary: #070614;
+            --bg-secondary: #0f0d26;
+            --bg-card: rgba(22, 20, 48, 0.5);
+            --border-color: rgba(255, 255, 255, 0.06);
+            --text-primary: #f1f1f7;
+            --text-secondary: #8c8aa7;
+            --accent: linear-gradient(135deg, #6366f1, #a855f7);
+            --accent-solid: #6366f1;
+            --green: #10b981;
+            --red: #f43f5e;
+            --amber: #f59e0b;
+        }
+
+        * {
+            box-sizing: border-box;
+            margin: 0;
+            padding: 0;
+            font-family: 'Inter', sans-serif;
+        }
+
+        body {
+            background-color: var(--bg-primary);
+            background-image: radial-gradient(circle at 10% 20%, rgba(99, 102, 241, 0.1) 0%, transparent 40%),
+                              radial-gradient(circle at 90% 80%, rgba(168, 85, 247, 0.08) 0%, transparent 40%);
+            background-attachment: fixed;
+            color: var(--text-primary);
+            min-height: 100vh;
+            display: flex;
+            flex-direction: column;
+            overflow-x: hidden;
+        }
+
+        header {
+            background: rgba(15, 13, 38, 0.7);
+            backdrop-filter: blur(12px);
+            border-bottom: 1px solid var(--border-color);
+            padding: 1.25rem 2rem;
+            display: flex;
+            justify-content: space-between;
+            align-items: center;
+            position: sticky;
+            top: 0;
+            z-index: 100;
+        }
+
+        .header-title {
+            display: flex;
+            align-items: center;
+            gap: 0.75rem;
+        }
+
+        .header-title h1 {
+            font-size: 1.25rem;
+            font-weight: 700;
+            letter-spacing: -0.025em;
+            background: var(--accent);
+            -webkit-background-clip: text;
+            -webkit-text-fill-color: transparent;
+        }
+
+        .status-badge {
+            background: rgba(16, 185, 129, 0.15);
+            color: var(--green);
+            font-size: 0.75rem;
+            padding: 0.25rem 0.6rem;
+            border-radius: 9999px;
+            font-weight: 600;
+            display: flex;
+            align-items: center;
+            gap: 0.35rem;
+            border: 1px solid rgba(16, 185, 129, 0.25);
+        }
+
+        .status-badge::before {
+            content: '';
+            display: inline-block;
+            width: 6px;
+            height: 6px;
+            background-color: var(--green);
+            border-radius: 50%;
+            box-shadow: 0 0 8px var(--green);
+            animation: pulse 1.5s infinite;
+        }
+
+        @keyframes pulse {
+            0% { transform: scale(0.95); opacity: 0.5; }
+            50% { transform: scale(1.2); opacity: 1; }
+            100% { transform: scale(0.95); opacity: 0.5; }
+        }
+
+        .header-actions {
+            display: flex;
+            align-items: center;
+            gap: 1rem;
+        }
+
+        .btn {
+            background: var(--accent);
+            border: none;
+            color: white;
+            padding: 0.6rem 1.2rem;
+            border-radius: 8px;
+            font-weight: 600;
+            font-size: 0.875rem;
+            cursor: pointer;
+            transition: all 0.2s ease;
+            display: flex;
+            align-items: center;
+            gap: 0.5rem;
+        }
+
+        .btn:hover {
+            transform: translateY(-1px);
+            box-shadow: 0 4px 12px rgba(99, 102, 241, 0.3);
+        }
+
+        .btn-secondary {
+            background: rgba(255, 255, 255, 0.05);
+            border: 1px solid var(--border-color);
+            color: var(--text-primary);
+        }
+
+        .btn-secondary:hover {
+            background: rgba(255, 255, 255, 0.08);
+            box-shadow: none;
+        }
+
+        .btn-danger {
+            background: var(--red);
+        }
+
+        .btn-danger:hover {
+            box-shadow: 0 4px 12px rgba(244, 63, 94, 0.3);
+        }
+
+        .container {
+            flex: 1;
+            max-width: 1400px;
+            width: 100%;
+            margin: 0 auto;
+            padding: 2rem;
+            display: flex;
+            gap: 2rem;
+        }
+
+        .sidebar {
+            width: 250px;
+            display: flex;
+            flex-direction: column;
+            gap: 0.5rem;
+            flex-shrink: 0;
+        }
+
+        .nav-item {
+            display: flex;
+            align-items: center;
+            gap: 0.75rem;
+            padding: 0.8rem 1rem;
+            border-radius: 8px;
+            color: var(--text-secondary);
+            text-decoration: none;
+            font-weight: 500;
+            font-size: 0.95rem;
+            cursor: pointer;
+            transition: all 0.2s ease;
+            background: transparent;
+            border: none;
+            text-align: left;
+            width: 100%;
+        }
+
+        .nav-item:hover, .nav-item.active {
+            color: var(--text-primary);
+            background: rgba(255, 255, 255, 0.04);
+        }
+
+        .nav-item.active {
+            background: rgba(99, 102, 241, 0.1);
+            color: var(--accent-solid);
+            border-left: 3px solid var(--accent-solid);
+            padding-left: calc(1rem - 3px);
+        }
+
+        .main-content {
+            flex: 1;
+            min-width: 0;
+            display: flex;
+            flex-direction: column;
+            gap: 2rem;
+        }
+
+        .stats-grid {
+            display: grid;
+            grid-template-columns: repeat(auto-fit, minmax(220px, 1fr));
+            gap: 1.5rem;
+        }
+
+        .stat-card {
+            background: var(--bg-card);
+            backdrop-filter: blur(8px);
+            border: 1px solid var(--border-color);
+            padding: 1.5rem;
+            border-radius: 12px;
+            display: flex;
+            flex-direction: column;
+            gap: 0.5rem;
+        }
+
+        .stat-label {
+            font-size: 0.8rem;
+            color: var(--text-secondary);
+            text-transform: uppercase;
+            letter-spacing: 0.05em;
+            font-weight: 600;
+        }
+
+        .stat-value {
+            font-size: 1.8rem;
+            font-weight: 700;
+            color: var(--text-primary);
+        }
+
+        .stat-badge {
+            align-self: flex-start;
+            font-size: 0.7rem;
+            font-weight: 600;
+            padding: 0.15rem 0.4rem;
+            border-radius: 4px;
+            background: rgba(255, 255, 255, 0.05);
+        }
+
+        .card {
+            background: var(--bg-card);
+            backdrop-filter: blur(8px);
+            border: 1px solid var(--border-color);
+            border-radius: 12px;
+            overflow: hidden;
+            display: none;
+            animation: fadeIn 0.3s ease-in-out;
+        }
+
+        .card.active {
+            display: flex;
+            flex-direction: column;
+        }
+
+        @keyframes fadeIn {
+            from { opacity: 0; transform: translateY(4px); }
+            to { opacity: 1; transform: translateY(0); }
+        }
+
+        .card-header {
+            padding: 1.5rem;
+            border-bottom: 1px solid var(--border-color);
+            display: flex;
+            justify-content: space-between;
+            align-items: center;
+        }
+
+        .card-title {
+            font-size: 1.1rem;
+            font-weight: 600;
+        }
+
+        .card-body {
+            padding: 1.5rem;
+        }
+
+        /* Table styles */
+        .table-container {
+            overflow-x: auto;
+            width: 100%;
+        }
+
+        table {
+            width: 100%;
+            border-collapse: collapse;
+            text-align: left;
+        }
+
+        th {
+            padding: 0.75rem 1rem;
+            color: var(--text-secondary);
+            font-weight: 600;
+            font-size: 0.8rem;
+            text-transform: uppercase;
+            letter-spacing: 0.05em;
+            border-bottom: 1px solid var(--border-color);
+        }
+
+        td {
+            padding: 1rem;
+            border-bottom: 1px solid rgba(255, 255, 255, 0.03);
+            font-size: 0.9rem;
+            vertical-align: middle;
+        }
+
+        tr:last-child td {
+            border-bottom: none;
+        }
+
+        .peer-id-cell {
+            font-family: monospace;
+            color: var(--accent-solid);
+            background: rgba(99, 102, 241, 0.05);
+            padding: 0.2rem 0.4rem;
+            border-radius: 4px;
+            font-size: 0.85rem;
+            display: inline-flex;
+            align-items: center;
+            gap: 0.5rem;
+        }
+
+        .copy-btn {
+            background: transparent;
+            border: none;
+            color: var(--text-secondary);
+            cursor: pointer;
+            transition: color 0.2s;
+        }
+
+        .copy-btn:hover {
+            color: var(--text-primary);
+        }
+
+        .badge {
+            font-size: 0.75rem;
+            padding: 0.2rem 0.5rem;
+            border-radius: 6px;
+            font-weight: 600;
+            display: inline-block;
+        }
+
+        .badge-router { background: rgba(168, 85, 247, 0.15); color: #c084fc; border: 1px solid rgba(168, 85, 247, 0.25); }
+        .badge-node { background: rgba(99, 102, 241, 0.15); color: #818cf8; border: 1px solid rgba(99, 102, 241, 0.25); }
+        .badge-pending { background: rgba(245, 158, 11, 0.15); color: #fbbf24; border: 1px solid rgba(245, 158, 11, 0.25); }
+        .badge-approved { background: rgba(16, 185, 129, 0.15); color: #34d399; border: 1px solid rgba(16, 185, 129, 0.25); }
+        .badge-rejected { background: rgba(244, 63, 94, 0.15); color: #fb7185; border: 1px solid rgba(244, 63, 94, 0.25); }
+        .badge-banned { background: rgba(244, 63, 94, 0.2); color: #fda4af; border: 1px solid rgba(244, 63, 94, 0.3); }
+
+        /* Router specific card dashboard grid */
+        .router-cards-grid {
+            display: grid;
+            grid-template-columns: repeat(auto-fill, minmax(320px, 1fr));
+            gap: 1.5rem;
+        }
+
+        .router-item-card {
+            background: rgba(255, 255, 255, 0.02);
+            border: 1px solid var(--border-color);
+            border-radius: 8px;
+            padding: 1.25rem;
+            display: flex;
+            flex-direction: column;
+            gap: 0.75rem;
+        }
+
+        .router-header {
+            display: flex;
+            justify-content: space-between;
+            align-items: center;
+        }
+
+        .router-peer-id {
+            font-family: monospace;
+            font-weight: 600;
+            font-size: 0.85rem;
+            color: var(--text-primary);
+        }
+
+        .router-metrics {
+            display: flex;
+            gap: 1rem;
+            background: rgba(0,0,0,0.2);
+            padding: 0.5rem;
+            border-radius: 6px;
+            font-size: 0.8rem;
+        }
+
+        .router-metric-item {
+            flex: 1;
+            text-align: center;
+        }
+
+        .router-metric-val {
+            font-size: 1rem;
+            font-weight: 700;
+            color: var(--accent-solid);
+        }
+
+        .router-peers-list {
+            font-size: 0.75rem;
+            color: var(--text-secondary);
+            max-height: 80px;
+            overflow-y: auto;
+            padding-left: 1.25rem;
+        }
+
+        /* Form styling */
+        .form-group {
+            margin-bottom: 1.25rem;
+            display: flex;
+            flex-direction: column;
+            gap: 0.5rem;
+        }
+
+        label {
+            font-size: 0.85rem;
+            font-weight: 600;
+            color: var(--text-secondary);
+        }
+
+        input, select, textarea {
+            background: rgba(0, 0, 0, 0.3);
+            border: 1px solid var(--border-color);
+            border-radius: 6px;
+            color: var(--text-primary);
+            padding: 0.75rem;
+            font-size: 0.9rem;
+            transition: all 0.2s;
+            width: 100%;
+        }
+
+        input:focus, select:focus, textarea:focus {
+            outline: none;
+            border-color: var(--accent-solid);
+            box-shadow: 0 0 0 2px rgba(99, 102, 241, 0.15);
+        }
+
+        /* Policy YAML textarea styling */
+        .yaml-editor-container {
+            display: flex;
+            flex-direction: column;
+            gap: 1rem;
+            height: 500px;
+        }
+
+        .yaml-editor {
+            font-family: 'Courier New', Courier, monospace;
+            font-size: 0.9rem;
+            resize: none;
+            background: #05040d;
+            border: 1px solid var(--border-color);
+            border-radius: 8px;
+            padding: 1rem;
+            line-height: 1.4;
+            color: #d8b4fe;
+        }
+
+        /* Modal styling */
+        .modal-overlay {
+            position: fixed;
+            top: 0;
+            left: 0;
+            right: 0;
+            bottom: 0;
+            background: rgba(5, 4, 16, 0.8);
+            backdrop-filter: blur(12px);
+            z-index: 1000;
+            display: flex;
+            align-items: center;
+            justify-content: center;
+            opacity: 0;
+            pointer-events: none;
+            transition: opacity 0.3s ease;
+        }
+
+        .modal-overlay.active {
+            opacity: 1;
+            pointer-events: auto;
+        }
+
+        .modal {
+            background: var(--bg-secondary);
+            border: 1px solid var(--border-color);
+            border-radius: 16px;
+            width: 90%;
+            max-width: 450px;
+            padding: 2rem;
+            box-shadow: 0 10px 30px rgba(0, 0, 0, 0.5);
+            display: flex;
+            flex-direction: column;
+            gap: 1.5rem;
+            transform: scale(0.95);
+            transition: transform 0.3s ease;
+        }
+
+        .modal-overlay.active .modal {
+            transform: scale(1);
+        }
+
+        .modal-header h2 {
+            font-size: 1.25rem;
+            font-weight: 700;
+        }
+
+        /* Toast notifications */
+        .toast-container {
+            position: fixed;
+            bottom: 2rem;
+            right: 2rem;
+            display: flex;
+            flex-direction: column;
+            gap: 0.75rem;
+            z-index: 2000;
+        }
+
+        .toast {
+            background: rgba(22, 20, 48, 0.9);
+            border-left: 4px solid var(--accent-solid);
+            border-top: 1px solid var(--border-color);
+            border-right: 1px solid var(--border-color);
+            border-bottom: 1px solid var(--border-color);
+            color: var(--text-primary);
+            padding: 1rem 1.5rem;
+            border-radius: 0 8px 8px 0;
+            font-size: 0.9rem;
+            font-weight: 500;
+            box-shadow: 0 4px 15px rgba(0,0,0,0.3);
+            display: flex;
+            align-items: center;
+            gap: 0.75rem;
+            transform: translateY(20px);
+            opacity: 0;
+            animation: slideIn 0.3s forwards ease-out;
+        }
+
+        @keyframes slideIn {
+            to { transform: translateY(0); opacity: 1; }
+        }
+
+        .toast.success { border-left-color: var(--green); }
+        .toast.error { border-left-color: var(--red); }
+    </style>
+</head>
+<body>
+
+    <header>
+        <div class="header-title">
+            <h1>Sovereign Agent Mesh</h1>
+            <span class="status-badge">Control Plane</span>
+        </div>
+        <div class="header-actions">
+            <button class="btn btn-secondary" onclick="openTokenModal()">Set Auth Token</button>
+            <button class="btn btn-danger" onclick="logout()" id="logout-btn" style="display: none;">Logout</button>
+        </div>
+    </header>
+
+    <div class="container">
+        <aside class="sidebar">
+            <button class="nav-item active" onclick="switchTab('tab-overview', this)">Overview</button>
+            <button class="nav-item" onclick="switchTab('tab-requests', this)" id="nav-requests">Enrollments Queue <span id="req-badge" class="badge badge-pending" style="display: none; margin-left: 0.25rem;">0</span></button>
+            <button class="nav-item" onclick="switchTab('tab-nodes', this)">Enrolled Nodes</button>
+            <button class="nav-item" onclick="switchTab('tab-routers', this)">Active Routers</button>
+            <button class="nav-item" onclick="switchTab('tab-bootstrap', this)">Bootstrap Tokens</button>
+            <button class="nav-item" onclick="switchTab('tab-policy', this)">Mesh Policy</button>
+        </aside>
+
+        <main class="main-content">
+            <!-- Stats overview -->
+            <div class="stats-grid">
+                <div class="stat-card">
+                    <span class="stat-label">Active Nodes</span>
+                    <span class="stat-value" id="stat-active-nodes">0</span>
+                    <span class="stat-badge" id="stat-banned-nodes">0 Banned</span>
+                </div>
+                <div class="stat-card">
+                    <span class="stat-label">Active Routers</span>
+                    <span class="stat-value" id="stat-active-routers">0</span>
+                    <span class="stat-badge" id="stat-total-connections">0 Connected Peers</span>
+                </div>
+                <div class="stat-card">
+                    <span class="stat-label">Pending Enrollments</span>
+                    <span class="stat-value" id="stat-pending-reqs">0</span>
+                    <span class="stat-badge" id="stat-resolved-reqs">0 Resolved</span>
+                </div>
+                <div class="stat-card">
+                    <span class="stat-label">Bootstrap Tokens</span>
+                    <span class="stat-value" id="stat-tokens">0</span>
+                    <span class="stat-badge">Pre-Shared Auth</span>
+                </div>
+            </div>
+
+            <!-- TAB: Overview -->
+            <div class="card active" id="tab-overview">
+                <div class="card-header">
+                    <h2 class="card-title">Network Topography Overview</h2>
+                </div>
+                <div class="card-body">
+                    <div id="router-topography-list" class="router-cards-grid">
+                        <!-- Router list cards will be rendered dynamically -->
+                    </div>
+                </div>
+            </div>
+
+            <!-- TAB: Enrollment requests -->
+            <div class="card" id="tab-requests">
+                <div class="card-header">
+                    <h2 class="card-title">Pending Enrollments Queue</h2>
+                </div>
+                <div class="card-body">
+                    <div class="table-container">
+                        <table>
+                            <thead>
+                                <tr>
+                                    <th>Peer ID</th>
+                                    <th>Token ID</th>
+                                    <th>Created At</th>
+                                    <th>Status</th>
+                                    <th>Actions</th>
+                                </tr>
+                            </thead>
+                            <tbody id="enrollments-tbody">
+                                <!-- Dynamic rows -->
+                            </tbody>
+                        </table>
+                    </div>
+                </div>
+            </div>
+
+            <!-- TAB: Enrolled Nodes -->
+            <div class="card" id="tab-nodes">
+                <div class="card-header">
+                    <h2 class="card-title">Enrolled Mesh Nodes</h2>
+                </div>
+                <div class="card-body">
+                    <div class="table-container">
+                        <table>
+                            <thead>
+                                <tr>
+                                    <th>Peer ID</th>
+                                    <th>Role</th>
+                                    <th>Type</th>
+                                    <th>Enrolled At</th>
+                                    <th>Expires At</th>
+                                    <th>Status</th>
+                                    <th>Action</th>
+                                </tr>
+                            </thead>
+                            <tbody id="nodes-tbody">
+                                <!-- Dynamic rows -->
+                            </tbody>
+                        </table>
+                    </div>
+                </div>
+            </div>
+
+            <!-- TAB: Active Routers -->
+            <div class="card" id="tab-routers">
+                <div class="card-header">
+                    <h2 class="card-title">Active Mesh Routers (Leases)</h2>
+                </div>
+                <div class="card-body">
+                    <div class="table-container">
+                        <table>
+                            <thead>
+                                <tr>
+                                    <th>Peer ID</th>
+                                    <th>Multiaddresses</th>
+                                    <th>Last Renewal</th>
+                                    <th>Expires At</th>
+                                    <th>DHT Size</th>
+                                    <th>Connected Peers</th>
+                                </tr>
+                            </thead>
+                            <tbody id="routers-tbody">
+                                <!-- Dynamic rows -->
+                            </tbody>
+                        </table>
+                    </div>
+                </div>
+            </div>
+
+            <!-- TAB: Bootstrap Tokens -->
+            <div class="card" id="tab-bootstrap">
+                <div class="card-header">
+                    <h2 class="card-title">Generate Bootstrap Token</h2>
+                </div>
+                <div class="card-body" style="display: flex; flex-direction: column; gap: 2rem;">
+                    <form id="token-form" onsubmit="generateToken(event)">
+                        <div style="display: grid; grid-template-columns: 1fr 1fr; gap: 1.5rem;">
+                            <div class="form-group">
+                                <label for="token-role">Role</label>
+                                <select id="token-role">
+                                    <option value="sam:role:node">sam:role:node</option>
+                                    <option value="sam:role:router">sam:role:router</option>
+                                </select>
+                            </div>
+                            <div class="form-group">
+                                <label for="token-ttl">TTL (Hours)</label>
+                                <input type="number" id="token-ttl" value="24" min="1">
+                            </div>
+                        </div>
+                        <div style="display: grid; grid-template-columns: 1fr 1fr; gap: 1.5rem;">
+                            <div class="form-group">
+                                <label for="token-usages">Max Usages</label>
+                                <input type="number" id="token-usages" value="1" min="1">
+                            </div>
+                            <div class="form-group">
+                                <label for="token-desc">Description</label>
+                                <input type="text" id="token-desc" placeholder="e.g. For router VM bootstrap">
+                            </div>
+                        </div>
+                        <button type="submit" class="btn" style="margin-top: 0.5rem;">Generate Token</button>
+                    </form>
+
+                    <div style="border-top: 1px solid var(--border-color); padding-top: 1.5rem;">
+                        <h3 style="margin-bottom: 1rem; font-size: 1rem; font-weight: 600;">Active Bootstrap Tokens</h3>
+                        <div class="table-container">
+                            <table>
+                                <thead>
+                                    <tr>
+                                        <th>ID Hash</th>
+                                        <th>Role</th>
+                                        <th>Usages</th>
+                                        <th>Expires At</th>
+                                        <th>Description</th>
+                                    </tr>
+                                </thead>
+                                <tbody id="tokens-tbody">
+                                    <!-- Dynamic rows -->
+                                </tbody>
+                            </table>
+                        </div>
+                    </div>
+                </div>
+            </div>
+
+            <!-- TAB: Mesh Policy -->
+            <div class="card" id="tab-policy">
+                <div class="card-header">
+                    <h2 class="card-title">Mesh Security Policies Configuration</h2>
+                </div>
+                <div class="card-body yaml-editor-container">
+                    <textarea class="yaml-editor" id="policy-yaml" placeholder="# Loading policy configuration..."></textarea>
+                    <button class="btn" onclick="savePolicy()">Save & Apply Policy</button>
+                </div>
+            </div>
+        </main>
+    </div>
+
+    <!-- Modal for Admin Token -->
+    <div class="modal-overlay" id="token-modal">
+        <div class="modal">
+            <div class="modal-header">
+                <h2>Control Plane Authentication</h2>
+            </div>
+            <div class="form-group">
+                <label for="admin-token-input">Admin Token (Bearer Key)</label>
+                <input type="password" id="admin-token-input" placeholder="Enter admin authorization token">
+            </div>
+            <div style="display: flex; gap: 1rem; justify-content: flex-end;">
+                <button class="btn btn-secondary" onclick="closeTokenModal()">Cancel</button>
+                <button class="btn" onclick="saveAdminToken()">Save Token</button>
+            </div>
+        </div>
+    </div>
+
+    <!-- Toast Notifications Container -->
+    <div class="toast-container" id="toast-container"></div>
+
+    <script>
+        function escapeHTML(str) {
+            if (!str) return '';
+            return str.replace(/[&<>"']/g, function(m) {
+                switch (m) {
+                    case '&': return '&amp;';
+                    case '<': return '&lt;';
+                    case '>': return '&gt;';
+                    case '"': return '&quot;';
+                    case "'": return '&#039;';
+                    default: return m;
+                }
+            });
+        }
+
+        let adminToken = localStorage.getItem('sam_admin_token') || '';
+        let modalCancelled = false;
+
+        function writeVarint(value) {
+            const bytes = [];
+            while (value > 127) {
+                bytes.push((value & 127) | 128);
+                value >>>= 7;
+            }
+            bytes.push(value);
+            return bytes;
+        }
+
+        function showToast(message, type) {
+            type = type || 'success';
+            const container = document.getElementById('toast-container');
+            const toast = document.createElement('div');
+            toast.className = 'toast ' + type;
+            toast.textContent = message;
+            container.appendChild(toast);
+            setTimeout(function() {
+                toast.style.opacity = '0';
+                toast.style.transform = 'translateY(10px)';
+                setTimeout(function() { toast.remove(); }, 300);
+            }, 3000);
+        }
+
+        function openTokenModal() {
+            modalCancelled = false;
+            document.getElementById('admin-token-input').value = adminToken;
+            document.getElementById('token-modal').classList.add('active');
+        }
+
+        function closeTokenModal() {
+            document.getElementById('token-modal').classList.remove('active');
+            modalCancelled = true;
+        }
+
+        function saveAdminToken() {
+            const val = document.getElementById('admin-token-input').value.trim();
+            adminToken = val;
+            localStorage.setItem('sam_admin_token', val);
+            document.getElementById('logout-btn').style.display = val ? 'block' : 'none';
+            closeTokenModal();
+            showToast('Authorization token updated');
+            fetchData();
+        }
+
+        function logout() {
+            adminToken = '';
+            localStorage.removeItem('sam_admin_token');
+            document.getElementById('logout-btn').style.display = 'none';
+            showToast('Authorization cleared');
+            fetchData();
+        }
+
+        if (adminToken) {
+            document.getElementById('logout-btn').style.display = 'block';
+        }
+
+        function switchTab(tabId, el) {
+            document.querySelectorAll('.card').forEach(function(c) { c.classList.remove('active'); });
+            document.querySelectorAll('.nav-item').forEach(function(n) { n.classList.remove('active'); });
+            document.getElementById(tabId).classList.add('active');
+            el.classList.add('active');
+        }
+
+        function copyToClipboard(text) {
+            if (!navigator.clipboard) {
+                const textArea = document.createElement("textarea");
+                textArea.value = text;
+                textArea.style.position = "fixed";
+                document.body.appendChild(textArea);
+                textArea.focus();
+                textArea.select();
+                try {
+                    document.execCommand('copy');
+                    showToast('Copied to clipboard');
+                } catch (err) {
+                    showToast('Failed to copy', 'error');
+                }
+                document.body.removeChild(textArea);
+                return;
+            }
+            navigator.clipboard.writeText(text).then(function() {
+                showToast('Copied to clipboard');
+            }).catch(function(err) {
+                showToast('Failed to copy', 'error');
+            });
+        }
+
+        async function apiCall(endpoint, method, body) {
+            method = method || 'GET';
+            body = body || null;
+            const headers = {};
+            if (adminToken) {
+                headers['Authorization'] = 'Bearer ' + adminToken;
+            }
+            if (body && typeof body === 'object') {
+                headers['Content-Type'] = 'application/json';
+            }
+
+            const options = { method: method, headers: headers };
+            if (body) {
+                options.body = typeof body === 'object' ? JSON.stringify(body) : body;
+            }
+
+            try {
+                const response = await fetch(endpoint, options);
+                if (response.status === 401) {
+                    showToast('Unauthorized: Check your admin token', 'error');
+                    if (!modalCancelled) {
+                        openTokenModal();
+                    }
+                    return null;
+                }
+                if (!response.ok) {
+                    const text = await response.text();
+                    showToast(text || 'API call failed', 'error');
+                    return null;
+                }
+                if (response.headers.get('Content-Type') && response.headers.get('Content-Type').includes('application/json')) {
+                    return await response.json();
+                }
+                return await response.text();
+            } catch (err) {
+                showToast('Network error: ' + err.message, 'error');
+                return null;
+            }
+        }
+
+        async function fetchData() {
+            const data = await apiCall('/admin/status');
+            if (!data) return;
+
+            // Update stats indicators
+            const nodes = data.enrolled_nodes || [];
+            const activeNodes = nodes.filter(function(n) { return !n.Banned; });
+            const bannedNodes = nodes.filter(function(n) { return n.Banned; });
+            document.getElementById('stat-active-nodes').textContent = activeNodes.length;
+            document.getElementById('stat-banned-nodes').textContent = bannedNodes.length + ' Banned';
+
+            const routers = data.active_routers || [];
+            document.getElementById('stat-active-routers').textContent = routers.length;
+            let peerCount = 0;
+            routers.forEach(function(r) {
+                if (r.ConnectedPeers) {
+                    peerCount += r.ConnectedPeers.length;
+                }
+            });
+            document.getElementById('stat-total-connections').textContent = peerCount + ' Connected Peers';
+
+            const reqs = data.enrollment_requests || [];
+            const pendingReqs = reqs.filter(function(r) { return r.Status === 1; }); // PENDING
+            const resolvedReqs = reqs.filter(function(r) { return r.Status !== 1; });
+            document.getElementById('stat-pending-reqs').textContent = pendingReqs.length;
+            document.getElementById('stat-resolved-reqs').textContent = resolvedReqs.length + ' Resolved';
+            
+            const reqBadge = document.getElementById('req-badge');
+            if (pendingReqs.length > 0) {
+                reqBadge.textContent = pendingReqs.length;
+                reqBadge.style.display = 'inline-block';
+            } else {
+                reqBadge.style.display = 'none';
+            }
+
+            const tokens = data.bootstrap_tokens || [];
+            document.getElementById('stat-tokens').textContent = tokens.length;
+
+            // Render Overview / Topography list
+            const topoList = document.getElementById('router-topography-list');
+            topoList.innerHTML = '';
+            if (routers.length === 0) {
+                topoList.innerHTML = '<div style="grid-column: 1/-1; text-align: center; color: var(--text-secondary); padding: 2rem;">No active routers online in the mesh.</div>';
+            } else {
+                routers.forEach(function(r) {
+                    const conns = r.ConnectedPeers || [];
+                    const dhtSize = r.DHTSize || 0;
+                    const elapsed = Math.max(0, Math.floor((new Date(r.ExpiresAt) - new Date()) / 1000));
+                    
+                    let peersHTML = '';
+                    if (conns.length === 0) {
+                        peersHTML = '<li>No connected peers</li>';
+                    } else {
+                        conns.forEach(function(p) {
+                            peersHTML += '<li>' + escapeHTML(p.substring(0, 15)) + '... (' + escapeHTML(p.substring(p.length - 8)) + ')</li>';
+                        });
+                    }
+
+                    topoList.innerHTML += 
+                        '<div class="router-item-card">' +
+                            '<div class="router-header">' +
+                                '<span class="router-peer-id" title="' + escapeHTML(r.PeerID) + '">' + escapeHTML(r.PeerID.substring(0, 12)) + '...' + escapeHTML(r.PeerID.substring(r.PeerID.length - 8)) + '</span>' +
+                                '<span class="status-badge" style="background: rgba(16,185,129,0.1); color: var(--green); border-color: rgba(16,185,129,0.15)">Lease: ' + elapsed + 's</span>' +
+                            '</div>' +
+                            '<div class="router-metrics">' +
+                                '<div class="router-metric-item">' +
+                                    '<div class="router-metric-val">' + conns.length + '</div>' +
+                                    '<div style="font-size: 0.7rem; color: var(--text-secondary)">Connections</div>' +
+                                '</div>' +
+                                '<div class="router-metric-item" style="border-left: 1px solid var(--border-color)">' +
+                                    '<div class="router-metric-val">' + dhtSize + '</div>' +
+                                    '<div style="font-size: 0.7rem; color: var(--text-secondary)">DHT Size</div>' +
+                                '</div>' +
+                            '</div>' +
+                            '<div style="font-size: 0.8rem; font-weight: 600; color: var(--text-secondary)">Connected Peers:</div>' +
+                            '<ul class="router-peers-list">' + peersHTML + '</ul>' +
+                        '</div>';
+                });
+            }
+
+            // Render Enrollments Queue
+            const enrollTbody = document.getElementById('enrollments-tbody');
+            enrollTbody.innerHTML = '';
+            if (reqs.length === 0) {
+                enrollTbody.innerHTML = '<tr><td colspan="5" style="text-align: center; color: var(--text-secondary);">No enrollment requests found.</td></tr>';
+            } else {
+                reqs.forEach(function(r) {
+                    let statusBadge = '';
+                    let actionButtons = '';
+                    const dateStr = new Date(r.CreatedAt).toLocaleString();
+
+                    const escapedID = escapeHTML(r.ID);
+                    const escapedPeerID = escapeHTML(r.PeerID);
+                    const escapedResolvedBy = escapeHTML(r.ResolvedBy || '');
+
+                    if (r.Status === 1) { // PENDING
+                        statusBadge = '<span class="badge badge-pending">PENDING</span>';
+                        actionButtons = 
+                            '<button class="btn btn-secondary" style="padding: 0.4rem 0.8rem; font-size: 0.75rem; background: var(--green);" onclick="resolveEnrollment(\'' + escapedID + '\', \'approve\')">Approve</button>' +
+                            '<button class="btn btn-danger" style="padding: 0.4rem 0.8rem; font-size: 0.75rem;" onclick="resolveEnrollment(\'' + escapedID + '\', \'reject\')">Reject</button>';
+                    } else if (r.Status === 2) { // APPROVED
+                        statusBadge = '<span class="badge badge-approved">APPROVED</span>';
+                        actionButtons = '<span style="font-size:0.8rem; color:var(--text-secondary)">By ' + escapedResolvedBy + '</span>';
+                    } else if (r.Status === 3) { // REJECTED
+                        statusBadge = '<span class="badge badge-rejected">REJECTED</span>';
+                        actionButtons = '<span style="font-size:0.8rem; color:var(--text-secondary)">By ' + escapedResolvedBy + '</span>';
+                    }
+
+                    enrollTbody.innerHTML += 
+                        '<tr>' +
+                            '<td>' +
+                                '<div class="peer-id-cell">' +
+                                    '<span>' + escapedPeerID.substring(0, 16) + '...</span>' +
+                                    '<button class="copy-btn" onclick="copyToClipboard(\'' + escapedPeerID + '\')">📋</button>' +
+                                '</div>' +
+                            '</td>' +
+                            '<td style="font-family: monospace; font-size:0.8rem;">' + (r.TokenID ? escapeHTML(r.TokenID).substring(0, 8) + '...' : 'OIDC') + '</td>' +
+                            '<td>' + dateStr + '</td>' +
+                            '<td>' + statusBadge + '</td>' +
+                            '<td style="display: flex; gap: 0.5rem;">' + actionButtons + '</td>' +
+                        '</tr>';
+                });
+            }
+
+            // Render Enrolled Nodes
+            const nodesTbody = document.getElementById('nodes-tbody');
+            nodesTbody.innerHTML = '';
+            if (nodes.length === 0) {
+                nodesTbody.innerHTML = '<tr><td colspan="7" style="text-align: center; color: var(--text-secondary);">No nodes registered.</td></tr>';
+            } else {
+                nodes.forEach(function(n) {
+                    const statusBadge = n.Banned ? '<span class="badge badge-rejected">BANNED</span>' : '<span class="badge badge-approved">ACTIVE</span>';
+                    const enrollDate = new Date(n.EnrolledAt).toLocaleString();
+                    const expiryDate = n.ExpiresAt && !n.ExpiresAt.startsWith('0001') ? new Date(n.ExpiresAt).toLocaleString() : 'Never';
+                    const roleBadge = n.Role.includes('router') ? 'badge-router' : 'badge-node';
+                    
+                    const escapedPeerID = escapeHTML(n.PeerID);
+                    const escapedRole = escapeHTML(n.Role);
+                    const escapedType = escapeHTML(n.EnrollmentType);
+                    
+                    const actionBtn = n.Banned 
+                        ? '<button class="btn btn-secondary" style="padding: 0.35rem 0.75rem; font-size: 0.75rem;" onclick="toggleBan(\'' + escapedPeerID + '\', false)">Unban</button>'
+                        : '<button class="btn btn-danger" style="padding: 0.35rem 0.75rem; font-size: 0.75rem;" onclick="toggleBan(\'' + escapedPeerID + '\', true)">Ban</button>';
+
+                    nodesTbody.innerHTML += 
+                        '<tr>' +
+                            '<td>' +
+                                '<div class="peer-id-cell">' +
+                                    '<span>' + escapedPeerID.substring(0, 16) + '...</span>' +
+                                    '<button class="copy-btn" onclick="copyToClipboard(\'' + escapedPeerID + '\')">📋</button>' +
+                                '</div>' +
+                            '</td>' +
+                            '<td><span class="badge ' + roleBadge + '">' + escapedRole + '</span></td>' +
+                            '<td><span style="font-weight:600; font-size:0.8rem;">' + escapedType + '</span></td>' +
+                            '<td>' + enrollDate + '</td>' +
+                            '<td>' + expiryDate + '</td>' +
+                            '<td>' + statusBadge + '</td>' +
+                            '<td>' + actionBtn + '</td>' +
+                        '</tr>';
+                });
+            }
+
+            // Render Routers list table
+            const routersTbody = document.getElementById('routers-tbody');
+            routersTbody.innerHTML = '';
+            if (routers.length === 0) {
+                routersTbody.innerHTML = '<tr><td colspan="6" style="text-align: center; color: var(--text-secondary);">No active routers online.</td></tr>';
+            } else {
+                routers.forEach(function(r) {
+                    const addressesHTML = r.Addresses.map(function(a) { return '<div style="font-family: monospace; font-size:0.75rem; margin-bottom: 0.2rem;">' + escapeHTML(a) + '</div>'; }).join('');
+                    const renewalDate = new Date(r.LastRenewal).toLocaleTimeString();
+                    const expiryDate = new Date(r.ExpiresAt).toLocaleTimeString();
+                    const conns = r.ConnectedPeers || [];
+                    const dhtSize = r.DHTSize || 0;
+
+                    const escapedPeerID = escapeHTML(r.PeerID);
+
+                    routersTbody.innerHTML += 
+                        '<tr>' +
+                            '<td>' +
+                                '<div class="peer-id-cell">' +
+                                    '<span>' + escapedPeerID.substring(0, 16) + '...</span>' +
+                                    '<button class="copy-btn" onclick="copyToClipboard(\'' + escapedPeerID + '\')">📋</button>' +
+                                '</div>' +
+                            '</td>' +
+                            '<td>' + addressesHTML + '</td>' +
+                            '<td>' + renewalDate + '</td>' +
+                            '<td>' + expiryDate + '</td>' +
+                            '<td style="font-weight: 700; color: var(--accent-solid); text-align: center;">' + dhtSize + '</td>' +
+                            '<td style="text-align: center;"><span class="badge badge-node">' + conns.length + ' Peers</span></td>' +
+                        '</tr>';
+                });
+            }
+
+            // Render Bootstrap Tokens
+            const tokensTbody = document.getElementById('tokens-tbody');
+            tokensTbody.innerHTML = '';
+            if (tokens.length === 0) {
+                tokensTbody.innerHTML = '<tr><td colspan="5" style="text-align: center; color: var(--text-secondary);">No bootstrap tokens created.</td></tr>';
+            } else {
+                tokens.forEach(function(t) {
+                    const expDate = new Date(t.ExpiresAt).toLocaleString();
+                    const usageStr = t.UsagesCount + '/' + t.MaxUsages;
+
+                    const escapedID = escapeHTML(t.ID);
+                    const escapedRole = escapeHTML(t.Role);
+                    const escapedDesc = escapeHTML(t.Description || '');
+
+                    tokensTbody.innerHTML += 
+                        '<tr>' +
+                            '<td style="font-family: monospace; font-size:0.8rem;">' + escapedID.substring(0, 16) + '...</td>' +
+                            '<td><span class="badge ' + (escapedRole.includes('router') ? 'badge-router' : 'badge-node') + '">' + escapedRole + '</span></td>' +
+                            '<td style="font-weight: 600;">' + usageStr + '</td>' +
+                            '<td>' + expDate + '</td>' +
+                            '<td style="color:var(--text-secondary); font-size:0.8rem;">' + escapedDesc + '</td>' +
+                        '</tr>';
+                });
+            }
+
+            // Update Policy YAML if empty/not edited
+            const policyArea = document.getElementById('policy-yaml');
+            if (data.policy_yaml && !policyArea.dataset.edited) {
+                policyArea.value = data.policy_yaml;
+            }
+        }
+
+        // Track user typing in policy editor to avoid stomping it
+        document.getElementById('policy-yaml').addEventListener('input', function(e) {
+            e.target.dataset.edited = "true";
+        });
+
+        async function resolveEnrollment(id, action) {
+            const res = await apiCall('/admin/enrollments/' + id + '/' + action, 'POST');
+            if (res !== null) {
+                showToast('Enrollment request ' + action + 'ed');
+                fetchData();
+            }
+        }
+
+        async function toggleBan(peerId, ban) {
+            const endpoint = '/admin/revoke';
+            const encoder = new TextEncoder();
+            const peerIdBytes = encoder.encode(peerId);
+            const lenBytes = writeVarint(peerIdBytes.length);
+            const pbBytes = new Uint8Array(1 + lenBytes.length + peerIdBytes.length);
+            pbBytes[0] = 0x0a;
+            pbBytes.set(lenBytes, 1);
+            pbBytes.set(peerIdBytes, 1 + lenBytes.length);
+
+            const headers = {};
+            if (adminToken) {
+                headers['Authorization'] = 'Bearer ' + adminToken;
+            }
+            headers['Content-Type'] = 'application/x-protobuf';
+
+            try {
+                const response = await fetch(endpoint, {
+                    method: 'POST',
+                    headers: headers,
+                    body: pbBytes
+                });
+                if (response.ok) {
+                    showToast(ban ? 'Node revoked (banned)' : 'Node active (unbanned)');
+                    fetchData();
+                } else {
+                    const text = await response.text();
+                    showToast('Action failed: ' + text, 'error');
+                }
+            } catch (err) {
+                showToast('Network error: ' + err.message, 'error');
+            }
+        }
+
+        async function generateToken(e) {
+            e.preventDefault();
+            const role = document.getElementById('token-role').value;
+            const ttl = parseInt(document.getElementById('token-ttl').value);
+            const maxUsages = parseInt(document.getElementById('token-usages').value);
+            const desc = document.getElementById('token-desc').value;
+
+            const res = await apiCall('/admin/bootstrap-tokens', 'POST', {
+                role: role,
+                ttl_hours: ttl,
+                max_usages: maxUsages,
+                description: desc
+            });
+
+            if (res) {
+                showToast('Token generated successfully');
+                document.getElementById('token-desc').value = '';
+                alert('Bootstrap Token Generated!\n\nToken Value: ' + res.token + '\n\nCopy this value now. It will not be shown again!');
+                fetchData();
+            }
+        }
+
+        async function savePolicy() {
+            const yamlContent = document.getElementById('policy-yaml').value;
+            const encoder = new TextEncoder();
+            const yamlBytes = encoder.encode(yamlContent);
+            
+            const lenBytes = writeVarint(yamlBytes.length);
+            const pbBytes = new Uint8Array(1 + lenBytes.length + yamlBytes.length);
+            pbBytes[0] = 0x0a;
+            pbBytes.set(lenBytes, 1);
+            pbBytes.set(yamlBytes, 1 + lenBytes.length);
+
+            const headers = {};
+            if (adminToken) {
+                headers['Authorization'] = 'Bearer ' + adminToken;
+            }
+            headers['Content-Type'] = 'application/x-protobuf';
+
+            try {
+                const response = await fetch('/policies', {
+                    method: 'POST',
+                    headers: headers,
+                    body: pbBytes
+                });
+                if (response.ok) {
+                    showToast('Mesh policy updated and applied');
+                    delete document.getElementById('policy-yaml').dataset.edited;
+                    fetchData();
+                } else {
+                    const text = await response.text();
+                    showToast('Failed to save policy: ' + text, 'error');
+                }
+            } catch (err) {
+                showToast('Network error: ' + err.message, 'error');
+            }
+        }
+
+        // Initial fetch and poll loop
+        async function poll() {
+            await fetchData();
+            setTimeout(poll, 5000);
+        }
+        poll();
+    </script>
+</body>
+</html>
+`
diff --git a/internal/identity/biscuit.go b/internal/identity/biscuit.go
index 3e7078dd..b6d1eb5c 100644
--- a/internal/identity/biscuit.go
+++ b/internal/identity/biscuit.go
@@ -31,17 +31,37 @@ import (
 	"github.com/libp2p/go-libp2p/core/peer"
 )
 
-// // MintBiscuitToken generates a signed Biscuit token for a peer with policy rules based on JWT claims.
-func MintBiscuitToken(signingKey ed25519.PrivateKey, claims jwt.MapClaims, token *oidc.IDToken, remotePeer peer.ID, policy *api.PolicyConfig, biscuitExpiry time.Time) ([]byte, []string, error) {
+// MintBiscuitToken generates a signed Biscuit token for a peer with policy rules based on JWT claims.
+//
+// Role Authorization Rationale:
+// The system has two distinct kinds of roles:
+//  1. Capability Roles (prefixed with "sam:role:"): These authorize the client's binary startup role
+//     (e.g., sam:role:node, sam:role:router, sam:role:sambox) under Zero Trust.
+//  2. Custom Access Roles (all other roles): These define authorization permissions for custom
+//     services and targets (e.g., restricted-role).
+//
+// When enrolling:
+//   - The client binary must explicitly request a single capability role (requestedRole).
+//   - We verify if the client's OIDC identity is authorized to claim that requested capability role:
+//   - If the user has explicitly mapped capability roles (from policy/claims), they must only request one of those.
+//   - If the user has no capability roles mapped, they are allowed to request the standard fallback role ("sam:role:node").
+//   - Once authorized, the generated Biscuit is minted with:
+//   - The requested capability role (enforcing least privilege).
+//   - All other custom access roles mapped to the identity (so they preserve their resource permissions).
+func MintBiscuitToken(signingKey ed25519.PrivateKey, claims jwt.MapClaims, token *oidc.IDToken, remotePeer peer.ID, policy *api.PolicyConfig, biscuitExpiry time.Time, requestedRole string) ([]byte, []string, error) {
 	if claims == nil {
 		return nil, nil, fmt.Errorf("claims cannot be nil")
 	}
+	if requestedRole == "" {
+		return nil, nil, fmt.Errorf("requested_role must be specified")
+	}
 
 	oidcRoles := toStringSlice(claims["roles"])
 	oidcGroups := toStringSlice(claims["groups"])
 	oidcSub, _ := claims["sub"].(string)
 	oidcEmail, _ := claims["email"].(string)
 
+	// Resolve all roles assigned to this identity by policy bindings or direct OIDC roles.
 	resolvedRoles := make(map[string]bool)
 	if policy != nil {
 		for _, b := range policy.Bindings {
@@ -55,8 +75,7 @@ func MintBiscuitToken(signingKey ed25519.PrivateKey, claims jwt.MapClaims, token
 				if len(parts) != 2 {
 					continue
 				}
-				prefix := parts[0]
-				value := parts[1]
+				prefix, value := parts[0], parts[1]
 
 				switch prefix {
 				case api.FactGroup:
@@ -88,29 +107,40 @@ func MintBiscuitToken(signingKey ed25519.PrivateKey, claims jwt.MapClaims, token
 		}
 	}
 
-	roles := make([]string, 0, len(resolvedRoles))
-	for role := range resolvedRoles {
-		roles = append(roles, role)
-	}
+	// Categorize resolved roles into Capability roles (sam:role:*) and Custom Access roles.
+	var hasCapabilityRoles bool
+	var customAccessRoles []string
 
-	// Ensure all tokens have a defined sam:role. If no custom role is resolved,
-	// assign the default node role: sam:role:node.
-	hasSamRole := false
-	for _, r := range roles {
+	for r := range resolvedRoles {
 		if strings.HasPrefix(r, "sam:role:") {
-			hasSamRole = true
-			break
+			hasCapabilityRoles = true
+		} else if r != requestedRole {
+			customAccessRoles = append(customAccessRoles, r)
 		}
 	}
-	if !hasSamRole {
-		roles = append(roles, api.RoleNode)
+
+	// Verify that the requested capability role is authorized.
+	isAuthorized := false
+	if resolvedRoles[requestedRole] {
+		isAuthorized = true
+	} else if requestedRole == api.RoleNode && !hasCapabilityRoles {
+		// Default fallback capability if no capability roles are explicitly assigned.
+		isAuthorized = true
+	}
+
+	if !isAuthorized {
+		return nil, nil, fmt.Errorf("requested role %q is not authorized for this identity", requestedRole)
 	}
 
-	biscuitBytes, err := mintBiscuit(signingKey, remotePeer, roles, biscuitExpiry, policy, claims)
+	// Assemble final roles: the single requested capability role + all custom access roles.
+	finalRoles := []string{requestedRole}
+	finalRoles = append(finalRoles, customAccessRoles...)
+
+	biscuitBytes, err := mintBiscuit(signingKey, remotePeer, finalRoles, biscuitExpiry, policy, claims)
 	if err != nil {
 		return nil, nil, err
 	}
-	return biscuitBytes, roles, nil
+	return biscuitBytes, finalRoles, nil
 }
 
 func mintBiscuit(signingKey ed25519.PrivateKey, remotePeer peer.ID, roles []string, expiration time.Time, policy *api.PolicyConfig, claims jwt.MapClaims) ([]byte, error) {
@@ -343,9 +373,14 @@ func mintBiscuit(signingKey ed25519.PrivateKey, remotePeer peer.ID, roles []stri
 // 2. The token is not expired.
 // 3. The token is securely bound to the expected remotePeer.
 func VerifyBiscuit(biscuitData []byte, expectedPeer peer.ID, trustedPublicKeys []ed25519.PublicKey, timeout time.Duration) (*biscuit.Biscuit, error) {
+	b, _, err := VerifyBiscuitAndGetKey(biscuitData, expectedPeer, trustedPublicKeys, timeout)
+	return b, err
+}
+
+func VerifyBiscuitAndGetKey(biscuitData []byte, expectedPeer peer.ID, trustedPublicKeys []ed25519.PublicKey, timeout time.Duration) (*biscuit.Biscuit, ed25519.PublicKey, error) {
 	b, err := biscuit.Unmarshal(biscuitData)
 	if err != nil {
-		return nil, fmt.Errorf("malformed biscuit: %w", err)
+		return nil, nil, fmt.Errorf("malformed biscuit: %w", err)
 	}
 
 	var authOpts []biscuit.AuthorizerOption
@@ -355,6 +390,7 @@ func VerifyBiscuit(biscuitData []byte, expectedPeer peer.ID, trustedPublicKeys [
 
 	var lastErr error
 	var authorized bool
+	var verifyingKey ed25519.PublicKey
 	for _, pubKey := range trustedPublicKeys {
 		authorizer, err := b.Authorizer(pubKey, authOpts...)
 		if err != nil {
@@ -374,6 +410,7 @@ func VerifyBiscuit(biscuitData []byte, expectedPeer peer.ID, trustedPublicKeys [
 
 		if err := authorizer.Authorize(); err == nil {
 			authorized = true
+			verifyingKey = pubKey
 			break
 		} else {
 			lastErr = err
@@ -381,7 +418,7 @@ func VerifyBiscuit(biscuitData []byte, expectedPeer peer.ID, trustedPublicKeys [
 	}
 
 	if !authorized {
-		return nil, fmt.Errorf("no valid key found for verification: %v", lastErr)
+		return nil, nil, fmt.Errorf("no valid key found for verification: %v", lastErr)
 	}
 
 	// Enforce hardware binding
@@ -390,10 +427,10 @@ func VerifyBiscuit(biscuitData []byte, expectedPeer peer.ID, trustedPublicKeys [
 		IDs:  []biscuit.Term{biscuit.String(expectedPeer.String())},
 	}}
 	if _, err := b.GetBlockID(boundFact); err != nil {
-		return nil, fmt.Errorf("token is not bound to peer %s: %w", expectedPeer, err)
+		return nil, nil, fmt.Errorf("token is not bound to peer %s: %w", expectedPeer, err)
 	}
 
-	return b, nil
+	return b, verifyingKey, nil
 }
 
 func translateClaimsToFacts(addFact func(biscuit.Fact) error, claims map[string]any) error {
@@ -531,3 +568,31 @@ func VerifyAndExtractPeerID(trustedPublicKeys []ed25519.PublicKey, biscuitData [
 
 	return pID, nil
 }
+
+// VerifyBiscuitRole checks that the biscuit is signed by the hub's public key
+// and contains the specified role fact.
+func VerifyBiscuitRole(biscuitData []byte, hubPubKey ed25519.PublicKey, expectedRole string) error {
+	b, err := biscuit.Unmarshal(biscuitData)
+	if err != nil {
+		return fmt.Errorf("malformed biscuit: %w", err)
+	}
+
+	authorizer, err := b.Authorizer(hubPubKey)
+	if err != nil {
+		return fmt.Errorf("failed to create authorizer: %w", err)
+	}
+
+	authorizer.AddCheck(biscuit.Check{Queries: []biscuit.Rule{
+		{
+			Body: []biscuit.Predicate{
+				{Name: api.FactRole, IDs: []biscuit.Term{biscuit.String(expectedRole)}},
+			},
+		},
+	}})
+	authorizer.AddPolicy(api.AllowIfTruePolicy)
+
+	if err := authorizer.Authorize(); err != nil {
+		return fmt.Errorf("biscuit lacks expected role %q: %w", expectedRole, err)
+	}
+	return nil
+}
diff --git a/internal/identity/biscuit_test.go b/internal/identity/biscuit_test.go
index 36255c31..1bf9c05f 100644
--- a/internal/identity/biscuit_test.go
+++ b/internal/identity/biscuit_test.go
@@ -70,7 +70,7 @@ func TestMintBiscuitToken(t *testing.T) {
 	claims1 := jwt.MapClaims{
 		"roles": []any{"admin"},
 	}
-	biscuitData1, _, err := MintBiscuitToken(priv, claims1, token, dummyPeer, policy, token.Expiry)
+	biscuitData1, _, err := MintBiscuitToken(priv, claims1, token, dummyPeer, policy, token.Expiry, "admin")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -104,7 +104,7 @@ func TestMintBiscuitToken(t *testing.T) {
 	claims2 := jwt.MapClaims{
 		"groups": []any{"system:serviceaccounts:sam-canary"},
 	}
-	biscuitData2, _, err := MintBiscuitToken(priv, claims2, token, dummyPeer, policy, token.Expiry)
+	biscuitData2, _, err := MintBiscuitToken(priv, claims2, token, dummyPeer, policy, token.Expiry, "canary-role")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -135,7 +135,7 @@ func TestMintBiscuitToken(t *testing.T) {
 		"groups": []any{"unknown-group"},
 		"roles":  []any{"undefined-role"},
 	}
-	biscuitData3, _, err := MintBiscuitToken(priv, claims3, token, dummyPeer, policy, token.Expiry)
+	biscuitData3, _, err := MintBiscuitToken(priv, claims3, token, dummyPeer, policy, token.Expiry, api.RoleNode)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -164,7 +164,7 @@ func TestMintBiscuitToken(t *testing.T) {
 	claims4 := jwt.MapClaims{
 		"sub": "system:serviceaccount:sam-canary:sam-node-sa",
 	}
-	biscuitData4, _, err := MintBiscuitToken(priv, claims4, token, dummyPeer, policy, token.Expiry)
+	biscuitData4, _, err := MintBiscuitToken(priv, claims4, token, dummyPeer, policy, token.Expiry, "canary-role")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -231,7 +231,7 @@ func TestVerifyBiscuit_Expiration(t *testing.T) {
 				"roles": []any{"admin"},
 			}
 
-			biscuitData, _, err := MintBiscuitToken(priv, claims, token, dummyPeer, &api.PolicyConfig{}, token.Expiry)
+			biscuitData, _, err := MintBiscuitToken(priv, claims, token, dummyPeer, &api.PolicyConfig{}, token.Expiry, api.RoleNode)
 			if err != nil {
 				t.Fatalf("MintBiscuitToken failed: %v", err)
 			}
@@ -283,7 +283,7 @@ func TestMintBiscuitToken_ClaimsTranslation(t *testing.T) {
 		"groups": []any{"beta-testers", "engineering"},
 	}
 
-	biscuitData, _, err := MintBiscuitToken(priv, claims, token, dummyPeer, policy, token.Expiry)
+	biscuitData, _, err := MintBiscuitToken(priv, claims, token, dummyPeer, policy, token.Expiry, "developer-role")
 	if err != nil {
 		t.Fatalf("Failed to mint biscuit: %v", err)
 	}
@@ -426,22 +426,27 @@ func TestMintBiscuitToken_VariousClaimsTypes(t *testing.T) {
 				claims["groups"] = tt.groupsClaim
 			}
 
-			biscuitData, _, err := MintBiscuitToken(priv, claims, token, dummyPeer, policy, token.Expiry)
-			if err != nil {
-				t.Fatalf("MintBiscuitToken failed: %v", err)
+			rolesToTest := tt.expectedRoles
+			if len(rolesToTest) == 0 {
+				rolesToTest = []string{api.RoleNode}
 			}
 
-			b, err := biscuit.Unmarshal(biscuitData)
-			if err != nil {
-				t.Fatalf("Unmarshal biscuit failed: %v", err)
-			}
+			for _, r := range rolesToTest {
+				biscuitData, _, err := MintBiscuitToken(priv, claims, token, dummyPeer, policy, token.Expiry, r)
+				if err != nil {
+					t.Fatalf("MintBiscuitToken failed for role %s: %v", r, err)
+				}
 
-			authorizer, err := b.Authorizer(pub, biscuit.WithWorldOptions(datalog.WithMaxDuration(500*time.Millisecond)))
-			if err != nil {
-				t.Fatalf("Authorizer failed: %v", err)
-			}
+				b, err := biscuit.Unmarshal(biscuitData)
+				if err != nil {
+					t.Fatalf("Unmarshal biscuit failed: %v", err)
+				}
+
+				authorizer, err := b.Authorizer(pub, biscuit.WithWorldOptions(datalog.WithMaxDuration(500*time.Millisecond)))
+				if err != nil {
+					t.Fatalf("Authorizer failed: %v", err)
+				}
 
-			for _, r := range tt.expectedRoles {
 				authorizer.AddCheck(biscuit.Check{Queries: []biscuit.Rule{
 					{
 						Body: []biscuit.Predicate{
@@ -449,27 +454,27 @@ func TestMintBiscuitToken_VariousClaimsTypes(t *testing.T) {
 						},
 					},
 				}})
-			}
 
-			for _, g := range tt.expectedGroups {
-				authorizer.AddCheck(biscuit.Check{Queries: []biscuit.Rule{
-					{
-						Body: []biscuit.Predicate{
-							{Name: "group", IDs: []biscuit.Term{biscuit.String(g)}},
+				for _, g := range tt.expectedGroups {
+					authorizer.AddCheck(biscuit.Check{Queries: []biscuit.Rule{
+						{
+							Body: []biscuit.Predicate{
+								{Name: "group", IDs: []biscuit.Term{biscuit.String(g)}},
+							},
 						},
-					},
-				}})
-			}
+					}})
+				}
 
-			authorizer.AddPolicy(biscuit.Policy{Queries: []biscuit.Rule{
-				{
-					Head: biscuit.Predicate{Name: "allow", IDs: []biscuit.Term{}},
-					Body: []biscuit.Predicate{},
-				},
-			}, Kind: biscuit.PolicyKindAllow})
+				authorizer.AddPolicy(biscuit.Policy{Queries: []biscuit.Rule{
+					{
+						Head: biscuit.Predicate{Name: "allow", IDs: []biscuit.Term{}},
+						Body: []biscuit.Predicate{},
+					},
+				}, Kind: biscuit.PolicyKindAllow})
 
-			if err := authorizer.Authorize(); err != nil {
-				t.Errorf("Verification failed for case: %v\nWorld:\n%s", err, authorizer.PrintWorld())
+				if err := authorizer.Authorize(); err != nil {
+					t.Errorf("Verification failed for case %s, role %s: %v\nWorld:\n%s", tt.name, r, err, authorizer.PrintWorld())
+				}
 			}
 		})
 	}
@@ -498,7 +503,7 @@ func TestVerifyBiscuit_Concurrent(t *testing.T) {
 		"roles": []any{"admin"},
 	}
 
-	biscuitData, _, err := MintBiscuitToken(priv, claims, token, dummyPeer, &api.PolicyConfig{}, token.Expiry)
+	biscuitData, _, err := MintBiscuitToken(priv, claims, token, dummyPeer, &api.PolicyConfig{}, token.Expiry, api.RoleNode)
 	if err != nil {
 		t.Fatalf("MintBiscuitToken failed: %v", err)
 	}
@@ -556,7 +561,7 @@ func TestMintBiscuitToken_ErrorAggregation(t *testing.T) {
 		"roles": []any{"admin"},
 	}
 
-	_, _, err = MintBiscuitToken(priv, claims, token, dummyPeer, policy, token.Expiry)
+	_, _, err = MintBiscuitToken(priv, claims, token, dummyPeer, policy, token.Expiry, "admin")
 	if err == nil {
 		t.Fatal("Expected MintBiscuitToken to fail on custom datalog syntax errors, got nil error")
 	}
@@ -608,7 +613,7 @@ func TestMintBiscuitToken_FactDeduplication(t *testing.T) {
 		"sub": "user-1",
 	}
 
-	biscuitData, _, err := MintBiscuitToken(priv, claims, token, dummyPeer, policy, token.Expiry)
+	biscuitData, _, err := MintBiscuitToken(priv, claims, token, dummyPeer, policy, token.Expiry, "role-a")
 	if err != nil {
 		t.Fatalf("MintBiscuitToken failed with duplicate facts: %v", err)
 	}
@@ -723,3 +728,77 @@ func TestMintBootstrapBiscuitToken(t *testing.T) {
 		t.Errorf("Expected custom node role service checks to succeed: %v", err)
 	}
 }
+
+func TestMintBiscuitToken_RoleAuthorizationValidation(t *testing.T) {
+	_, priv, err := ed25519.GenerateKey(rand.Reader)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	privNode, _, err := crypto.GenerateKeyPair(crypto.Ed25519, -1)
+	if err != nil {
+		t.Fatal(err)
+	}
+	dummyPeer, _ := peer.IDFromPrivateKey(privNode)
+
+	token := &oidc.IDToken{
+		Expiry: time.Now().Add(1 * time.Hour),
+	}
+
+	// Policy defining bindings for custom capability roles
+	policy := &api.PolicyConfig{
+		Bindings: []api.Binding{
+			{Role: "sam:role:sambox", Members: []string{"user:sambox-user"}},
+			{Role: "custom-access-role", Members: []string{"user:sambox-user"}},
+		},
+		Roles: map[string]api.RolePolicy{
+			"sam:role:sambox":    {},
+			"custom-access-role": {},
+		},
+	}
+
+	// 1. User has no mapped capability roles.
+	// Can request default "sam:role:node", but not "sam:role:router".
+	claimsUnmapped := jwt.MapClaims{"sub": "unmapped-user"}
+	_, _, err = MintBiscuitToken(priv, claimsUnmapped, token, dummyPeer, policy, token.Expiry, api.RoleNode)
+	if err != nil {
+		t.Errorf("expected unmapped user allowed to request default role %q, got: %v", api.RoleNode, err)
+	}
+	_, _, err = MintBiscuitToken(priv, claimsUnmapped, token, dummyPeer, policy, token.Expiry, api.RoleRouter)
+	if err == nil {
+		t.Errorf("expected unmapped user NOT allowed to request unauthorized role %q", api.RoleRouter)
+	}
+
+	// 2. User has mapped capability role "sam:role:sambox" and custom access role "custom-access-role".
+	// Can request "sam:role:sambox", but cannot request default "sam:role:node" or "sam:role:router".
+	claimsMapped := jwt.MapClaims{"sub": "sambox-user"}
+	_, finalRoles, err := MintBiscuitToken(priv, claimsMapped, token, dummyPeer, policy, token.Expiry, api.RoleSamBox)
+	if err != nil {
+		t.Errorf("expected mapped user allowed to request authorized role %q, got: %v", api.RoleSamBox, err)
+	}
+	// Check that custom access role is also preserved in final roles
+	hasCustomRole := false
+	for _, r := range finalRoles {
+		if r == "custom-access-role" {
+			hasCustomRole = true
+		}
+	}
+	if !hasCustomRole {
+		t.Errorf("expected custom access role to be preserved in final roles, got: %v", finalRoles)
+	}
+
+	_, _, err = MintBiscuitToken(priv, claimsMapped, token, dummyPeer, policy, token.Expiry, api.RoleNode)
+	if err == nil {
+		t.Errorf("expected mapped user NOT allowed to bypass map by requesting default role %q", api.RoleNode)
+	}
+	_, _, err = MintBiscuitToken(priv, claimsMapped, token, dummyPeer, policy, token.Expiry, api.RoleRouter)
+	if err == nil {
+		t.Errorf("expected mapped user NOT allowed to request unauthorized role %q", api.RoleRouter)
+	}
+
+	// 3. Requested role cannot be empty
+	_, _, err = MintBiscuitToken(priv, claimsMapped, token, dummyPeer, policy, token.Expiry, "")
+	if err == nil {
+		t.Error("expected MintBiscuitToken to reject empty requested_role")
+	}
+}
diff --git a/internal/node/enroll.go b/internal/node/enroll.go
index 44d31a0f..1274d371 100644
--- a/internal/node/enroll.go
+++ b/internal/node/enroll.go
@@ -25,6 +25,7 @@ import (
 	"time"
 
 	"github.com/google/sam/api"
+	"github.com/google/sam/internal/identity"
 	golog "github.com/ipfs/go-log/v2"
 	"github.com/libp2p/go-libp2p/core/crypto"
 	"github.com/multiformats/go-multiaddr"
@@ -63,9 +64,10 @@ func (n *SamNode) Enroll(ctx context.Context, hubURL string, jwt string) error {
 	}
 
 	req := &api.EnrollRequest{
-		Jwt:       jwt,
-		PeerId:    n.Host.ID().String(),
-		PublicKey: pubBytes,
+		Jwt:           jwt,
+		PeerId:        n.Host.ID().String(),
+		PublicKey:     pubBytes,
+		RequestedRole: n.config.RequiredRole,
 	}
 	data, err := proto.Marshal(req)
 	if err != nil {
@@ -124,6 +126,12 @@ func (n *SamNode) Enroll(ctx context.Context, hubURL string, jwt string) error {
 		return fmt.Errorf("received invalid hub public key size: %d bytes (expected %d)", len(enrollResp.HubPublicKey), ed25519.PublicKeySize)
 	}
 
+	if n.config.RequiredRole != "" {
+		if err := identity.VerifyBiscuitRole(enrollResp.BiscuitToken, ed25519.PublicKey(enrollResp.HubPublicKey), n.config.RequiredRole); err != nil {
+			return fmt.Errorf("enrolled biscuit token lacks required role %q: %w", n.config.RequiredRole, err)
+		}
+	}
+
 	if err := n.Store.SaveIdentity(enrollResp.BiscuitToken); err != nil {
 		return fmt.Errorf("failed to save identity: %v", err)
 	}
@@ -180,6 +188,7 @@ func (n *SamNode) EnrollBootstrap(ctx context.Context, hubURL string, bootstrapT
 		BootstrapToken: bootstrapToken,
 		PeerId:         n.Host.ID().String(),
 		PublicKey:      pubBytes,
+		RequestedRole:  n.config.RequiredRole,
 	}
 	data, err := proto.Marshal(req)
 	if err != nil {
@@ -298,6 +307,10 @@ func (n *SamNode) EnrollBootstrap(ctx context.Context, hubURL string, bootstrapT
 		return fmt.Errorf("received invalid hub public key size: %d bytes", len(enrollResp.HubPublicKey))
 	}
 
+	if err := identity.VerifyBiscuitRole(enrollResp.BiscuitToken, ed25519.PublicKey(enrollResp.HubPublicKey), n.config.RequiredRole); err != nil {
+		return fmt.Errorf("enrolled biscuit token lacks required role %q: %w", n.config.RequiredRole, err)
+	}
+
 	if err := n.Store.SaveIdentity(enrollResp.BiscuitToken); err != nil {
 		return fmt.Errorf("failed to save identity: %v", err)
 	}
diff --git a/internal/node/node.go b/internal/node/node.go
index f115d01c..7ecc0f74 100644
--- a/internal/node/node.go
+++ b/internal/node/node.go
@@ -265,6 +265,15 @@ func NewSamNode(cfg Options) (*SamNode, error) {
 
 // Start initializes the libp2p host, DHT, connects to the hub, and starts runtime components.
 func (n *SamNode) Start(ctx context.Context) error {
+	if biscuitBytes := n.GetIdentity(); len(biscuitBytes) > 0 {
+		hubPubKeyBytes, _, err := n.Store.LoadHubConfig()
+		if err == nil && len(hubPubKeyBytes) > 0 {
+			if err := identity.VerifyBiscuitRole(biscuitBytes, ed25519.PublicKey(hubPubKeyBytes), n.config.RequiredRole); err != nil {
+				return fmt.Errorf("loaded identity fails role requirement %q: %w", n.config.RequiredRole, err)
+			}
+		}
+	}
+
 	// Layer 2: Attach the Bouncer (Gater)
 	gater := &nodeConnGate{node: n}
 
diff --git a/internal/node/options.go b/internal/node/options.go
index 108eeb3d..40519148 100644
--- a/internal/node/options.go
+++ b/internal/node/options.go
@@ -19,6 +19,7 @@ import (
 	"fmt"
 	"time"
 
+	"github.com/google/sam/api"
 	"github.com/libp2p/go-libp2p/core/crypto"
 	"github.com/multiformats/go-multiaddr"
 )
@@ -55,6 +56,8 @@ type Options struct {
 	DHTMaxRecordAge      time.Duration
 	DHTLookupLimit       int
 	DiscoveryConcurrency int
+	// RequiredRole restricts enrollment and startup to only accept tokens containing this role.
+	RequiredRole string
 }
 
 // Default applies default values to Options if they are not specified.
@@ -92,6 +95,9 @@ func (o *Options) Default() {
 	if len(o.ListenAddrs) == 0 {
 		o.ListenAddrs = []string{"/ip4/0.0.0.0/udp/5001/quic-v1", "/ip4/0.0.0.0/tcp/5002"}
 	}
+	if o.RequiredRole == "" {
+		o.RequiredRole = api.RoleNode
+	}
 }
 
 // Validate verifies that the required options are provided and valid.
@@ -102,5 +108,8 @@ func (o *Options) Validate() error {
 	if o.Store == nil {
 		return fmt.Errorf("store is required")
 	}
+	if o.RequiredRole == "" {
+		return fmt.Errorf("RequiredRole must be specified")
+	}
 	return nil
 }
diff --git a/internal/node/static_service_test.go b/internal/node/static_service_test.go
index d45bc46f..d1c8cdfc 100644
--- a/internal/node/static_service_test.go
+++ b/internal/node/static_service_test.go
@@ -99,8 +99,32 @@ func startMockLibp2pHub(t *testing.T) (peer.ID, string) {
 			return
 		}
 
+		bBuilder := biscuit.NewBuilder(cpPriv)
+		_ = bBuilder.AddAuthorityFact(biscuit.Fact{Predicate: biscuit.Predicate{
+			Name: api.FactNode,
+			IDs:  []biscuit.Term{biscuit.String(req.PeerId)},
+		}})
+		_ = bBuilder.AddAuthorityFact(biscuit.Fact{Predicate: biscuit.Predicate{
+			Name: api.FactRole,
+			IDs:  []biscuit.Term{biscuit.String(api.RoleNode)},
+		}})
+		_ = bBuilder.AddAuthorityFact(biscuit.Fact{Predicate: biscuit.Predicate{
+			Name: api.FactExpiration,
+			IDs:  []biscuit.Term{biscuit.Date(time.Now().Add(24 * time.Hour))},
+		}})
+		bTok, err := bBuilder.Build()
+		if err != nil {
+			http.Error(w, "Failed to build biscuit", http.StatusInternalServerError)
+			return
+		}
+		biscuitBytes, err := bTok.Serialize()
+		if err != nil {
+			http.Error(w, "Failed to serialize biscuit", http.StatusInternalServerError)
+			return
+		}
+
 		resp := &api.EnrollResponse{
-			BiscuitToken: []byte("mock-biscuit-token"),
+			BiscuitToken: biscuitBytes,
 			HubPublicKey: cpPub,
 			HubAddresses: []string{h.Addrs()[0].String() + "/p2p/" + h.ID().String()},
 		}
diff --git a/internal/router/config.go b/internal/router/config.go
index d3b21152..176e0a68 100644
--- a/internal/router/config.go
+++ b/internal/router/config.go
@@ -17,6 +17,8 @@ package router
 import (
 	"fmt"
 	"time"
+
+	"github.com/google/sam/api"
 )
 
 // Options holds configuration details for the sam-router.
@@ -37,6 +39,8 @@ type Options struct {
 	LogVerbose         bool
 	DHTProviderAddrTTL time.Duration
 	DHTMaxRecordAge    time.Duration
+	// RequiredRole restricts enrollment and startup to only accept tokens containing this role.
+	RequiredRole string
 }
 
 // Default sets default values for options.
@@ -59,6 +63,9 @@ func (o *Options) Default() {
 	if o.BiscuitTimeout <= 0 {
 		o.BiscuitTimeout = 100 * time.Millisecond
 	}
+	if o.RequiredRole == "" {
+		o.RequiredRole = api.RoleRouter
+	}
 }
 
 // Validate ensures options are valid.
diff --git a/internal/router/router.go b/internal/router/router.go
index e2b7b3ba..19824794 100644
--- a/internal/router/router.go
+++ b/internal/router/router.go
@@ -288,9 +288,10 @@ func (r *Router) enroll(peerID peer.ID) error {
 	}
 
 	req := &api.EnrollRequest{
-		Jwt:       r.config.OIDCToken,
-		PeerId:    peerID.String(),
-		PublicKey: pubBytes,
+		Jwt:           r.config.OIDCToken,
+		PeerId:        peerID.String(),
+		PublicKey:     pubBytes,
+		RequestedRole: r.config.RequiredRole,
 	}
 	data, err := proto.Marshal(req)
 	if err != nil {
@@ -325,6 +326,10 @@ func (r *Router) enroll(peerID peer.ID) error {
 	r.trustedPublicKeys = []ed25519.PublicKey{enrollResp.HubPublicKey}
 	r.keysMu.Unlock()
 
+	if err := identity.VerifyBiscuitRole(enrollResp.BiscuitToken, enrollResp.HubPublicKey, r.config.RequiredRole); err != nil {
+		return fmt.Errorf("enrolled biscuit token lacks required role %q: %w", r.config.RequiredRole, err)
+	}
+
 	return nil
 }
 
@@ -339,6 +344,7 @@ func (r *Router) enrollBootstrap(peerID peer.ID) error {
 		BootstrapToken: r.config.BootstrapToken,
 		PeerId:         peerID.String(),
 		PublicKey:      pubBytes,
+		RequestedRole:  r.config.RequiredRole,
 	}
 	data, err := proto.Marshal(req)
 	if err != nil {
@@ -442,6 +448,10 @@ func (r *Router) enrollBootstrap(peerID peer.ID) error {
 	r.trustedPublicKeys = []ed25519.PublicKey{enrollResp.HubPublicKey}
 	r.keysMu.Unlock()
 
+	if err := identity.VerifyBiscuitRole(enrollResp.BiscuitToken, enrollResp.HubPublicKey, r.config.RequiredRole); err != nil {
+		return fmt.Errorf("enrolled biscuit token lacks required role %q: %w", r.config.RequiredRole, err)
+	}
+
 	logger.Infof("Router bootstrap enrollment approved! Biscuit received.")
 	return nil
 }
@@ -540,10 +550,23 @@ func (r *Router) renewLease() {
 		}
 	}
 
+	var connectedPeers []string
+	if r.Host != nil && r.Host.Network() != nil {
+		for _, p := range r.Host.Network().Peers() {
+			connectedPeers = append(connectedPeers, p.String())
+		}
+	}
+	var dhtSize int32
+	if r.DHT != nil && r.DHT.RoutingTable() != nil {
+		dhtSize = int32(r.DHT.RoutingTable().Size())
+	}
+
 	req := &api.RouterLeaseRequest{
-		PeerId:    r.Host.ID().String(),
-		Addresses: addrs,
-		Biscuit:   r.biscuitToken,
+		PeerId:         r.Host.ID().String(),
+		Addresses:      addrs,
+		Biscuit:        r.biscuitToken,
+		ConnectedPeers: connectedPeers,
+		DhtSize:        dhtSize,
 	}
 	data, _ := proto.Marshal(req)
 
@@ -747,7 +770,7 @@ func (r *Router) performMutualAuth(s network.Stream) error {
 		return fmt.Errorf("failed to verify peer router biscuit: %w", err)
 	}
 
-	// Enforce role("router"), role("router-role") or role("bootstrap") inside the biscuit
+	// Enforce required role inside the biscuit
 	authorizer, err := b.Authorizer(trustedKeys[0])
 	if err != nil {
 		return fmt.Errorf("authorizer instantiation failed: %w", err)
@@ -756,7 +779,7 @@ func (r *Router) performMutualAuth(s network.Stream) error {
 	authorizer.AddCheck(biscuit.Check{Queries: []biscuit.Rule{
 		{
 			Body: []biscuit.Predicate{
-				{Name: api.FactRole, IDs: []biscuit.Term{biscuit.String(api.RoleRouter)}},
+				{Name: api.FactRole, IDs: []biscuit.Term{biscuit.String(r.config.RequiredRole)}},
 			},
 		},
 	}})
diff --git a/internal/router/router_test.go b/internal/router/router_test.go
index 125475a2..a73389bd 100644
--- a/internal/router/router_test.go
+++ b/internal/router/router_test.go
@@ -229,9 +229,10 @@ func TestRouterIntegration(t *testing.T) {
 		t.Fatal(err)
 	}
 	enrollNodeReq := &api.EnrollRequest{
-		Jwt:       nodeJWT,
-		PeerId:    nodePeerID.String(),
-		PublicKey: nodePubKeyBytes,
+		Jwt:           nodeJWT,
+		PeerId:        nodePeerID.String(),
+		PublicKey:     nodePubKeyBytes,
+		RequestedRole: api.RoleNode,
 	}
 	reqData, _ := proto.Marshal(enrollNodeReq)
 	resp, err := client.Post(cpURL+"/register", "application/x-protobuf", bytes.NewReader(reqData))
diff --git a/internal/storage/sql_store.go b/internal/storage/sql_store.go
index 25a84a68..bbff3179 100644
--- a/internal/storage/sql_store.go
+++ b/internal/storage/sql_store.go
@@ -24,6 +24,7 @@ import (
 	"time"
 
 	"github.com/google/sam/api"
+	log "github.com/ipfs/go-log/v2"
 	"gopkg.in/yaml.v2"
 
 	// Register PG and SQLite drivers
@@ -31,6 +32,8 @@ import (
 	_ "modernc.org/sqlite"
 )
 
+var logger = log.Logger("sam-storage")
+
 // SQLStore implements Store interface using database/sql.
 type SQLStore struct {
 	db         *sql.DB
@@ -73,21 +76,24 @@ func (s *SQLStore) isPostgres() bool {
 	return strings.Contains(s.driverName, "postgres") || strings.Contains(s.driverName, "pgx")
 }
 
-func (s *SQLStore) initSchema() error {
-	var keyringSchema, nodesSchema, routersSchema, policiesSchema string
-	var bootstrapTokensSchema, enrollmentRequestsSchema string
+type migration struct {
+	version  int
+	sqlite   []string
+	postgres []string
+}
 
-	if s.isPostgres() {
-		keyringSchema = `
-			CREATE TABLE IF NOT EXISTS keyring (
+var migrations = []migration{
+	{
+		version: 1,
+		postgres: []string{
+			`CREATE TABLE IF NOT EXISTS keyring (
 				id SERIAL PRIMARY KEY,
 				private_key BYTEA NOT NULL,
 				public_key BYTEA NOT NULL UNIQUE,
 				expiration BIGINT,
 				created_at BIGINT NOT NULL
-			)`
-		nodesSchema = `
-			CREATE TABLE IF NOT EXISTS nodes (
+			)`,
+			`CREATE TABLE IF NOT EXISTS nodes (
 				peer_id VARCHAR(255) PRIMARY KEY,
 				public_key BYTEA NOT NULL,
 				biscuit_token BYTEA NOT NULL,
@@ -97,22 +103,19 @@ func (s *SQLStore) initSchema() error {
 				enrolled_at BIGINT NOT NULL,
 				expires_at BIGINT NOT NULL,
 				banned BOOLEAN DEFAULT FALSE NOT NULL
-			)`
-		routersSchema = `
-			CREATE TABLE IF NOT EXISTS routers (
+			)`,
+			`CREATE TABLE IF NOT EXISTS routers (
 				peer_id VARCHAR(255) PRIMARY KEY,
 				multiaddresses TEXT NOT NULL,
 				last_lease_renewal BIGINT NOT NULL,
 				expires_at BIGINT NOT NULL
-			)`
-		policiesSchema = `
-			CREATE TABLE IF NOT EXISTS policies (
+			)`,
+			`CREATE TABLE IF NOT EXISTS policies (
 				id VARCHAR(255) PRIMARY KEY,
 				content TEXT NOT NULL,
 				updated_at BIGINT NOT NULL
-			)`
-		bootstrapTokensSchema = `
-			CREATE TABLE IF NOT EXISTS bootstrap_tokens (
+			)`,
+			`CREATE TABLE IF NOT EXISTS bootstrap_tokens (
 				id VARCHAR(64) PRIMARY KEY,
 				token_hash VARCHAR(64) UNIQUE NOT NULL,
 				role VARCHAR(64) NOT NULL,
@@ -121,9 +124,8 @@ func (s *SQLStore) initSchema() error {
 				description TEXT,
 				created_at BIGINT NOT NULL,
 				expires_at BIGINT NOT NULL
-			)`
-		enrollmentRequestsSchema = `
-			CREATE TABLE IF NOT EXISTS enrollment_requests (
+			)`,
+			`CREATE TABLE IF NOT EXISTS enrollment_requests (
 				id VARCHAR(64) PRIMARY KEY,
 				peer_id VARCHAR(255) UNIQUE NOT NULL,
 				public_key BYTEA NOT NULL,
@@ -133,18 +135,17 @@ func (s *SQLStore) initSchema() error {
 				created_at BIGINT NOT NULL,
 				resolved_at BIGINT,
 				resolved_by VARCHAR(255)
-			)`
-	} else {
-		keyringSchema = `
-			CREATE TABLE IF NOT EXISTS keyring (
+			)`,
+		},
+		sqlite: []string{
+			`CREATE TABLE IF NOT EXISTS keyring (
 				id INTEGER PRIMARY KEY AUTOINCREMENT,
 				private_key BLOB NOT NULL,
 				public_key BLOB NOT NULL UNIQUE,
 				expiration BIGINT,
 				created_at BIGINT NOT NULL
-			)`
-		nodesSchema = `
-			CREATE TABLE IF NOT EXISTS nodes (
+			)`,
+			`CREATE TABLE IF NOT EXISTS nodes (
 				peer_id TEXT PRIMARY KEY,
 				public_key BLOB NOT NULL,
 				biscuit_token BLOB NOT NULL,
@@ -154,22 +155,19 @@ func (s *SQLStore) initSchema() error {
 				enrolled_at BIGINT NOT NULL,
 				expires_at BIGINT NOT NULL,
 				banned BOOLEAN DEFAULT FALSE NOT NULL
-			)`
-		routersSchema = `
-			CREATE TABLE IF NOT EXISTS routers (
+			)`,
+			`CREATE TABLE IF NOT EXISTS routers (
 				peer_id TEXT PRIMARY KEY,
 				multiaddresses TEXT NOT NULL,
 				last_lease_renewal BIGINT NOT NULL,
 				expires_at BIGINT NOT NULL
-			)`
-		policiesSchema = `
-			CREATE TABLE IF NOT EXISTS policies (
+			)`,
+			`CREATE TABLE IF NOT EXISTS policies (
 				id TEXT PRIMARY KEY,
 				content TEXT NOT NULL,
 				updated_at BIGINT NOT NULL
-			)`
-		bootstrapTokensSchema = `
-			CREATE TABLE IF NOT EXISTS bootstrap_tokens (
+			)`,
+			`CREATE TABLE IF NOT EXISTS bootstrap_tokens (
 				id TEXT PRIMARY KEY,
 				token_hash TEXT UNIQUE NOT NULL,
 				role TEXT NOT NULL,
@@ -178,9 +176,8 @@ func (s *SQLStore) initSchema() error {
 				description TEXT,
 				created_at BIGINT NOT NULL,
 				expires_at BIGINT NOT NULL
-			)`
-		enrollmentRequestsSchema = `
-			CREATE TABLE IF NOT EXISTS enrollment_requests (
+			)`,
+			`CREATE TABLE IF NOT EXISTS enrollment_requests (
 				id TEXT PRIMARY KEY,
 				peer_id TEXT UNIQUE NOT NULL,
 				public_key BLOB NOT NULL,
@@ -190,12 +187,74 @@ func (s *SQLStore) initSchema() error {
 				created_at BIGINT NOT NULL,
 				resolved_at BIGINT,
 				resolved_by TEXT
-			)`
+			)`,
+		},
+	},
+	{
+		version: 2,
+		postgres: []string{
+			`ALTER TABLE routers ADD COLUMN IF NOT EXISTS connected_peers TEXT`,
+			`ALTER TABLE routers ADD COLUMN IF NOT EXISTS dht_size INT`,
+		},
+		sqlite: []string{
+			`ALTER TABLE routers ADD COLUMN connected_peers TEXT`,
+			`ALTER TABLE routers ADD COLUMN dht_size INTEGER`,
+		},
+	},
+}
+
+func (s *SQLStore) initSchema() error {
+	// Create schema_migrations table
+	createMigrationsTable := `CREATE TABLE IF NOT EXISTS schema_migrations (version INTEGER PRIMARY KEY)`
+	if _, err := s.db.Exec(createMigrationsTable); err != nil {
+		return fmt.Errorf("failed to create schema_migrations table: %w", err)
+	}
+
+	var currentVersion int
+	err := s.db.QueryRow("SELECT COALESCE(MAX(version), 0) FROM schema_migrations").Scan(&currentVersion)
+	if err != nil {
+		return fmt.Errorf("failed to check current schema version: %w", err)
 	}
 
-	schemas := []string{keyringSchema, nodesSchema, routersSchema, policiesSchema, bootstrapTokensSchema, enrollmentRequestsSchema}
-	for _, schema := range schemas {
-		if _, err := s.db.Exec(schema); err != nil {
+	for _, m := range migrations {
+		if m.version <= currentVersion {
+			continue
+		}
+
+		err := func() error {
+			tx, err := s.db.Begin()
+			if err != nil {
+				return err
+			}
+			defer func() { _ = tx.Rollback() }()
+
+			queries := m.sqlite
+			if s.isPostgres() {
+				queries = m.postgres
+			}
+
+			for _, query := range queries {
+				if _, err := tx.Exec(query); err != nil {
+					errStr := strings.ToLower(err.Error())
+					if strings.Contains(errStr, "duplicate column") || strings.Contains(errStr, "already exists") {
+						continue
+					}
+					return fmt.Errorf("migration version %d failed: query %q failed: %w", m.version, query, err)
+				}
+			}
+
+			insertQuery := s.rebind("INSERT INTO schema_migrations (version) VALUES (?)")
+			if _, err := tx.Exec(insertQuery, m.version); err != nil {
+				return fmt.Errorf("failed to update schema_migrations version: %w", err)
+			}
+
+			if err := tx.Commit(); err != nil {
+				return err
+			}
+			logger.Infof("Applied schema migration version %d successfully", m.version)
+			return nil
+		}()
+		if err != nil {
 			return err
 		}
 	}
@@ -385,29 +444,33 @@ func (s *SQLStore) UpsertRouterLease(ctx context.Context, lease *RouterLease) er
 	if err != nil {
 		return err
 	}
+	peersBytes, err := json.Marshal(lease.ConnectedPeers)
+	if err != nil {
+		return err
+	}
 
 	var query string
 	if s.isPostgres() {
 		query = s.rebind(`
-			INSERT INTO routers (peer_id, multiaddresses, last_lease_renewal, expires_at) 
-			VALUES (?, ?, ?, ?)
+			INSERT INTO routers (peer_id, multiaddresses, last_lease_renewal, expires_at, connected_peers, dht_size) 
+			VALUES (?, ?, ?, ?, ?, ?)
 			ON CONFLICT (peer_id) 
-			DO UPDATE SET multiaddresses = EXCLUDED.multiaddresses, last_lease_renewal = EXCLUDED.last_lease_renewal, expires_at = EXCLUDED.expires_at`)
+			DO UPDATE SET multiaddresses = EXCLUDED.multiaddresses, last_lease_renewal = EXCLUDED.last_lease_renewal, expires_at = EXCLUDED.expires_at, connected_peers = EXCLUDED.connected_peers, dht_size = EXCLUDED.dht_size`)
 	} else {
 		query = s.rebind(`
-			INSERT INTO routers (peer_id, multiaddresses, last_lease_renewal, expires_at) 
-			VALUES (?, ?, ?, ?)
+			INSERT INTO routers (peer_id, multiaddresses, last_lease_renewal, expires_at, connected_peers, dht_size) 
+			VALUES (?, ?, ?, ?, ?, ?)
 			ON CONFLICT (peer_id) 
-			DO UPDATE SET multiaddresses = excluded.multiaddresses, last_lease_renewal = excluded.last_lease_renewal, expires_at = excluded.expires_at`)
+			DO UPDATE SET multiaddresses = excluded.multiaddresses, last_lease_renewal = excluded.last_lease_renewal, expires_at = excluded.expires_at, connected_peers = excluded.connected_peers, dht_size = excluded.dht_size`)
 	}
 
-	_, err = s.db.ExecContext(ctx, query, lease.PeerID, string(addrsBytes), lease.LastRenewal.UnixMilli(), lease.ExpiresAt.UnixMilli())
+	_, err = s.db.ExecContext(ctx, query, lease.PeerID, string(addrsBytes), lease.LastRenewal.UnixMilli(), lease.ExpiresAt.UnixMilli(), string(peersBytes), lease.DHTSize)
 	return err
 }
 
 // GetActiveRouters implements Store.
 func (s *SQLStore) GetActiveRouters(ctx context.Context) ([]RouterLease, error) {
-	query := s.rebind(`SELECT peer_id, multiaddresses, last_lease_renewal, expires_at FROM routers WHERE expires_at > ?`)
+	query := s.rebind(`SELECT peer_id, multiaddresses, last_lease_renewal, expires_at, connected_peers, dht_size FROM routers WHERE expires_at > ?`)
 	rows, err := s.db.QueryContext(ctx, query, time.Now().UnixMilli())
 	if err != nil {
 		return nil, err
@@ -418,13 +481,23 @@ func (s *SQLStore) GetActiveRouters(ctx context.Context) ([]RouterLease, error)
 	for rows.Next() {
 		var l RouterLease
 		var addrsStr string
+		var peersStr sql.NullString
+		var dhtSize sql.NullInt64
 		var lastRenewalUnix, expiresAtUnix int64
-		if err := rows.Scan(&l.PeerID, &addrsStr, &lastRenewalUnix, &expiresAtUnix); err != nil {
+		if err := rows.Scan(&l.PeerID, &addrsStr, &lastRenewalUnix, &expiresAtUnix, &peersStr, &dhtSize); err != nil {
 			return nil, err
 		}
 		if err := json.Unmarshal([]byte(addrsStr), &l.Addresses); err != nil {
 			return nil, err
 		}
+		if peersStr.Valid && peersStr.String != "" {
+			if err := json.Unmarshal([]byte(peersStr.String), &l.ConnectedPeers); err != nil {
+				return nil, err
+			}
+		}
+		if dhtSize.Valid {
+			l.DHTSize = int(dhtSize.Int64)
+		}
 		l.LastRenewal = time.UnixMilli(lastRenewalUnix)
 		l.ExpiresAt = time.UnixMilli(expiresAtUnix)
 		leases = append(leases, l)
@@ -648,6 +721,87 @@ func (s *SQLStore) UpdateEnrollmentRequest(ctx context.Context, id string, statu
 	return nil
 }
 
+// ListNodes retrieves all enrolled nodes.
+func (s *SQLStore) ListNodes(ctx context.Context) ([]EnrolledNode, error) {
+	query := s.rebind(`SELECT peer_id, public_key, biscuit_token, role, enrollment_type, claims_json, enrolled_at, expires_at, banned FROM nodes ORDER BY enrolled_at DESC`)
+	rows, err := s.db.QueryContext(ctx, query)
+	if err != nil {
+		return nil, fmt.Errorf("failed to query nodes: %w", err)
+	}
+	defer func() { _ = rows.Close() }()
+
+	var nodes []EnrolledNode
+	for rows.Next() {
+		var node EnrolledNode
+		var claimsJSON sql.NullString
+		var enrolledAtUnix, expiresAtUnix int64
+		err := rows.Scan(
+			&node.PeerID,
+			&node.PublicKey,
+			&node.Biscuit,
+			&node.Role,
+			&node.EnrollmentType,
+			&claimsJSON,
+			&enrolledAtUnix,
+			&expiresAtUnix,
+			&node.Banned,
+		)
+		if err != nil {
+			return nil, fmt.Errorf("failed to scan enrolled node: %w", err)
+		}
+		if claimsJSON.Valid {
+			node.ClaimsJSON = claimsJSON.String
+		}
+		node.EnrolledAt = time.UnixMilli(enrolledAtUnix)
+		node.ExpiresAt = time.UnixMilli(expiresAtUnix)
+		nodes = append(nodes, node)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return nodes, nil
+}
+
+// ListBootstrapTokens retrieves all bootstrap tokens.
+func (s *SQLStore) ListBootstrapTokens(ctx context.Context) ([]BootstrapToken, error) {
+	query := s.rebind(`SELECT id, token_hash, role, max_usages, usages_count, description, created_at, expires_at FROM bootstrap_tokens ORDER BY created_at DESC`)
+	rows, err := s.db.QueryContext(ctx, query)
+	if err != nil {
+		return nil, fmt.Errorf("failed to query bootstrap tokens: %w", err)
+	}
+	defer func() { _ = rows.Close() }()
+
+	var tokens []BootstrapToken
+	for rows.Next() {
+		var t BootstrapToken
+		var desc sql.NullString
+		var created, expires int64
+		err := rows.Scan(
+			&t.ID,
+			&t.TokenHash,
+			&t.Role,
+			&t.MaxUsages,
+			&t.UsagesCount,
+			&desc,
+			&created,
+			&expires,
+		)
+		if err != nil {
+			return nil, fmt.Errorf("failed to scan bootstrap token: %w", err)
+		}
+		if desc.Valid {
+			t.Description = desc.String
+		}
+		t.CreatedAt = time.Unix(created, 0)
+		t.ExpiresAt = time.Unix(expires, 0)
+		tokens = append(tokens, t)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return tokens, nil
+}
+
 // Close implements Store.
 func (s *SQLStore) Close() error {
 	return s.db.Close()
diff --git a/internal/storage/storage.go b/internal/storage/storage.go
index 151898d7..6c64c076 100644
--- a/internal/storage/storage.go
+++ b/internal/storage/storage.go
@@ -36,10 +36,12 @@ type KeyPair struct {
 
 // RouterLease represents a router registered with the control plane.
 type RouterLease struct {
-	PeerID      string
-	Addresses   []string
-	LastRenewal time.Time
-	ExpiresAt   time.Time
+	PeerID         string
+	Addresses      []string
+	LastRenewal    time.Time
+	ExpiresAt      time.Time
+	ConnectedPeers []string
+	DHTSize        int
 }
 
 // EnrolledNode represents a node enrolled in the mesh.
@@ -142,6 +144,12 @@ type Store interface {
 	// UpdateEnrollmentRequest updates status, resolved details, and stored Biscuit of a request.
 	UpdateEnrollmentRequest(ctx context.Context, id string, status api.EnrollmentStatus, biscuit []byte, resolvedBy string) error
 
+	// ListNodes retrieves all enrolled nodes.
+	ListNodes(ctx context.Context) ([]EnrolledNode, error)
+
+	// ListBootstrapTokens retrieves all bootstrap tokens.
+	ListBootstrapTokens(ctx context.Context) ([]BootstrapToken, error)
+
 	// Close closes the underlying database connection.
 	Close() error
 }
diff --git a/mobile/sam-node-ffi/ffi/ffi_test.go b/mobile/sam-node-ffi/ffi/ffi_test.go
index b760210e..f202b025 100644
--- a/mobile/sam-node-ffi/ffi/ffi_test.go
+++ b/mobile/sam-node-ffi/ffi/ffi_test.go
@@ -58,45 +58,7 @@ func TestMobileFFILifecycle(t *testing.T) {
 		println("--- MOCK HUB: received auth stream connection")
 		defer func() { _ = s.Close() }()
 
-		// Mint a valid Biscuit token signed by CP key and bound to mock hub's Peer ID
-		builder := biscuit.NewBuilder(cpPrivKey)
-		if err := builder.AddAuthorityFact(biscuit.Fact{
-			Predicate: biscuit.Predicate{
-				Name: "node",
-				IDs:  []biscuit.Term{biscuit.String(hubHost.ID().String())},
-			},
-		}); err != nil {
-			println("--- MOCK HUB: failed to add node fact:", err.Error())
-			return
-		}
-		if err := builder.AddAuthorityFact(biscuit.Fact{
-			Predicate: biscuit.Predicate{
-				Name: api.FactRole,
-				IDs:  []biscuit.Term{biscuit.String(api.RoleRouter)},
-			},
-		}); err != nil {
-			println("--- MOCK HUB: failed to add role fact:", err.Error())
-			return
-		}
-		if err := builder.AddAuthorityFact(biscuit.Fact{
-			Predicate: biscuit.Predicate{
-				Name: api.FactExpiration,
-				IDs:  []biscuit.Term{biscuit.Date(time.Now().Add(time.Hour))},
-			},
-		}); err != nil {
-			println("--- MOCK HUB: failed to add expiration fact:", err.Error())
-			return
-		}
-		b, err := builder.Build()
-		if err != nil {
-			println("--- MOCK HUB: failed to build biscuit:", err.Error())
-			return
-		}
-		biscuitBytes, err := b.Serialize()
-		if err != nil {
-			println("--- MOCK HUB: failed to serialize biscuit:", err.Error())
-			return
-		}
+		biscuitBytes := mintMockBiscuit(t, hubHost.ID().String(), cpPrivKey, api.RoleRouter)
 
 		resp := &api.AuthResponse{
 			Success: true,
@@ -117,8 +79,9 @@ func TestMobileFFILifecycle(t *testing.T) {
 		var req api.EnrollRequest
 		_ = proto.Unmarshal(body, &req)
 
+		biscuitBytes := mintMockBiscuit(t, req.PeerId, cpPrivKey, api.RoleNode)
 		resp := &api.EnrollResponse{
-			BiscuitToken: []byte("mock-biscuit-token"),
+			BiscuitToken: biscuitBytes,
 			HubPublicKey: cpPubKey,
 			HubAddresses: []string{hubHost.Addrs()[0].String() + "/p2p/" + hubHost.ID().String()},
 		}
@@ -173,3 +136,40 @@ func TestMobileFFILifecycle(t *testing.T) {
 		t.Fatalf("StopNode failed: %v", err)
 	}
 }
+
+func mintMockBiscuit(t *testing.T, peerID string, priv ed25519.PrivateKey, role string) []byte {
+	builder := biscuit.NewBuilder(priv)
+	if err := builder.AddAuthorityFact(biscuit.Fact{
+		Predicate: biscuit.Predicate{
+			Name: "node",
+			IDs:  []biscuit.Term{biscuit.String(peerID)},
+		},
+	}); err != nil {
+		t.Fatalf("failed to add node fact: %v", err)
+	}
+	if err := builder.AddAuthorityFact(biscuit.Fact{
+		Predicate: biscuit.Predicate{
+			Name: api.FactRole,
+			IDs:  []biscuit.Term{biscuit.String(role)},
+		},
+	}); err != nil {
+		t.Fatalf("failed to add role fact: %v", err)
+	}
+	if err := builder.AddAuthorityFact(biscuit.Fact{
+		Predicate: biscuit.Predicate{
+			Name: api.FactExpiration,
+			IDs:  []biscuit.Term{biscuit.Date(time.Now().Add(time.Hour))},
+		},
+	}); err != nil {
+		t.Fatalf("failed to add expiration fact: %v", err)
+	}
+	b, err := builder.Build()
+	if err != nil {
+		t.Fatalf("failed to build biscuit: %v", err)
+	}
+	biscuitBytes, err := b.Serialize()
+	if err != nil {
+		t.Fatalf("failed to serialize biscuit: %v", err)
+	}
+	return biscuitBytes
+}
diff --git a/site/content/docs/user/control-plane-configuration.md b/site/content/docs/user/control-plane-configuration.md
index 042c0159..a4273533 100644
--- a/site/content/docs/user/control-plane-configuration.md
+++ b/site/content/docs/user/control-plane-configuration.md
@@ -96,6 +96,26 @@ bindings:
     role: "developer-role"
 ```
 
+### 3.1 Binary Capability Roles (Zero Trust)
+To enforce the principle of least privilege, the Sovereign Agent Mesh implements binary-level capability authorization. Every binary connecting to the mesh must request its specific target role during enrollment:
+- `sam-node` requests `sam:role:node` (Default agent capability)
+- `sam-box` requests `sam:role:sambox` (Secure Gateway sidecar)
+- `sam-router` requests `sam:role:router` (P2P routing and relay service)
+
+The Hub control plane validates that the enrolling client is authorized for the requested role before issuing the Biscuit identity token:
+1. **Node Fallback**: By default, any successfully authenticated OIDC identity or generic bootstrap token can claim the `sam:role:node` role.
+2. **Explicit Bindings**: The higher-privilege capability roles `sam:role:router` and `sam:role:sambox` must be explicitly authorized to the user/service account by mapping the role name in `policies.yaml` bindings. For example:
+
+```yaml
+bindings:
+  - members: ["group:mesh-routers"]
+    role: "sam:role:router"
+  - members: ["user:gateway-pod-sa"]
+    role: "sam:role:sambox"
+```
+
+If a binary requests a capability role it is not authorized for, enrollment fails immediately. If a client attempts to start using a token that lacks its binary's required role, startup aborts.
+
 ---
 
 ## 4. Bootstrapping Example
diff --git a/site/content/docs/user/secure-gateway.md b/site/content/docs/user/secure-gateway.md
index 21ce6c1c..d9cd96be 100644
--- a/site/content/docs/user/secure-gateway.md
+++ b/site/content/docs/user/secure-gateway.md
@@ -129,7 +129,7 @@ spec:
       initContainers:
       - name: init-nano-init
         image: ghcr.io/google/sam-nano-init:latest
-        command: ["cp", "/nano-init", "/shared-bin/nano-init"]
+        command: ["/nano-init", "copy", "/shared-bin/nano-init"]
         volumeMounts:
         - name: shared-bin
           mountPath: /shared-bin
@@ -138,6 +138,7 @@ spec:
         image: python:3.11-alpine
         command:
           - "/shared-bin/nano-init"
+          - "run"
           - "/var/run/sam/sam-box.sock"
           - "python3"
           - "agent.py"
diff --git a/tests/e2e/gen_db.go b/tests/e2e/gen_db.go
index 06c67081..fce898b3 100644
--- a/tests/e2e/gen_db.go
+++ b/tests/e2e/gen_db.go
@@ -15,11 +15,16 @@
 package main
 
 import (
+	"crypto/ed25519"
+	"crypto/rand"
 	"encoding/json"
 	"log"
 	"os"
 	"path/filepath"
+	"time"
 
+	"github.com/biscuit-auth/biscuit-go/v2"
+	"github.com/google/sam/api"
 	"go.etcd.io/bbolt"
 )
 
@@ -40,18 +45,42 @@ func main() {
 	}
 	defer func() { _ = db.Close() }()
 
+	pub, priv, err := ed25519.GenerateKey(rand.Reader)
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	builder := biscuit.NewBuilder(priv)
+	_ = builder.AddAuthorityFact(biscuit.Fact{Predicate: biscuit.Predicate{
+		Name: api.FactNode,
+		IDs:  []biscuit.Term{biscuit.String("12D3KooWHUTskEt6EwWk8sgzxHS9CH5dU5XHdPonVCKEdHoKCTtD")},
+	}})
+	_ = builder.AddAuthorityFact(biscuit.Fact{Predicate: biscuit.Predicate{
+		Name: api.FactRole,
+		IDs:  []biscuit.Term{biscuit.String(api.RoleNode)},
+	}})
+	_ = builder.AddAuthorityFact(biscuit.Fact{Predicate: biscuit.Predicate{
+		Name: api.FactExpiration,
+		IDs:  []biscuit.Term{biscuit.Date(time.Now().Add(24 * time.Hour))},
+	}})
+	tok, err := builder.Build()
+	if err != nil {
+		log.Fatal(err)
+	}
+	biscuitBytes, err := tok.Serialize()
+	if err != nil {
+		log.Fatal(err)
+	}
+
 	err = db.Update(func(tx *bbolt.Tx) error {
 		b, err := tx.CreateBucketIfNotExists([]byte("identity"))
 		if err != nil {
 			return err
 		}
-		// The following constants are mock values used for testing.
-		// 'mock-biscuit-token' is a dummy token string.
-		// The hub public key is a dummy 32-byte hex string (all zeros).
-		if err := b.Put([]byte("identity_biscuit"), []byte("mock-biscuit-token")); err != nil {
+		if err := b.Put([]byte("identity_biscuit"), biscuitBytes); err != nil {
 			return err
 		}
-		if err := b.Put([]byte("hub_public_key"), []byte("0000000000000000000000000000000000000000000000000000000000000000")); err != nil {
+		if err := b.Put([]byte("hub_public_key"), pub); err != nil {
 			return err
 		}
 		addrsData, _ := json.Marshal([]string{"/ip4/127.0.0.1/tcp/4002/p2p/QmYyQSo1sn1GjUuQwca9AdvV8Zeyvmxrww8dDnewPrfJs9"})
diff --git a/tests/integration/fallback_test.go b/tests/integration/fallback_test.go
index 3a2cedbb..674b60bd 100644
--- a/tests/integration/fallback_test.go
+++ b/tests/integration/fallback_test.go
@@ -93,7 +93,7 @@ func TestSelfHealingHTTPFallback(t *testing.T) {
 			writer := msgio.NewVarintWriter(s)
 			resp := &api.AuthResponse{
 				Success: true,
-				Biscuit: createMockBiscuitToken(t, newH.ID().String(), priv),
+				Biscuit: createMockBiscuitToken(t, newH.ID().String(), priv, api.RoleRouter),
 			}
 			respBytes, _ := proto.Marshal(resp)
 			_ = writer.WriteMsg(respBytes)
@@ -155,7 +155,7 @@ func TestSelfHealingHTTPFallback(t *testing.T) {
 		}
 
 		resp := &api.EnrollResponse{
-			BiscuitToken: createMockBiscuitToken(t, enrollReq.PeerId, priv),
+			BiscuitToken: createMockBiscuitToken(t, enrollReq.PeerId, priv, api.RoleNode),
 			HubPublicKey: pub,
 			HubAddresses: []string{addr},
 		}
diff --git a/tests/integration/minimal_helpers_test.go b/tests/integration/minimal_helpers_test.go
index 48753146..1ebd9479 100644
--- a/tests/integration/minimal_helpers_test.go
+++ b/tests/integration/minimal_helpers_test.go
@@ -232,7 +232,7 @@ func startMockLibp2pHub(t *testing.T) (peer.ID, string) {
 		writer := msgio.NewVarintWriter(s)
 		resp := &api.AuthResponse{
 			Success: true,
-			Biscuit: createMockBiscuitToken(t, h.ID().String(), priv),
+			Biscuit: createMockBiscuitToken(t, h.ID().String(), priv, api.RoleRouter),
 		}
 		respBytes, _ := proto.Marshal(resp)
 		_ = writer.WriteMsg(respBytes)
@@ -263,7 +263,7 @@ func startMockLibp2pHub(t *testing.T) (peer.ID, string) {
 		}
 
 		resp := &api.EnrollResponse{
-			BiscuitToken: createMockBiscuitToken(t, req.PeerId, priv),
+			BiscuitToken: createMockBiscuitToken(t, req.PeerId, priv, api.RoleNode),
 			HubPublicKey: pub,
 			HubAddresses: []string{h.Addrs()[0].String() + "/p2p/" + h.ID().String()},
 		}
@@ -313,7 +313,7 @@ func startMockLibp2pHubWithOIDC(t *testing.T, oidcIssuerURL string) (peer.ID, st
 		writer := msgio.NewVarintWriter(s)
 		resp := &api.AuthResponse{
 			Success: true,
-			Biscuit: createMockBiscuitToken(t, h.ID().String(), priv),
+			Biscuit: createMockBiscuitToken(t, h.ID().String(), priv, api.RoleRouter),
 		}
 		respBytes, _ := proto.Marshal(resp)
 		_ = writer.WriteMsg(respBytes)
@@ -363,7 +363,7 @@ func startMockLibp2pHubWithOIDC(t *testing.T, oidcIssuerURL string) (peer.ID, st
 		}
 
 		resp := &api.EnrollResponse{
-			BiscuitToken: createMockBiscuitToken(t, req.PeerId, priv),
+			BiscuitToken: createMockBiscuitToken(t, req.PeerId, priv, api.RoleNode),
 			HubPublicKey: pub,
 			HubAddresses: []string{h.Addrs()[0].String() + "/p2p/" + h.ID().String()},
 		}
@@ -388,7 +388,7 @@ func startMockLibp2pHubWithOIDC(t *testing.T, oidcIssuerURL string) (peer.ID, st
 	return h.ID(), httpServer.URL
 }
 
-func createMockBiscuitToken(t *testing.T, peerID string, priv ed25519.PrivateKey) []byte {
+func createMockBiscuitToken(t *testing.T, peerID string, priv ed25519.PrivateKey, role string) []byte {
 	builder := biscuit.NewBuilder(priv)
 	err := builder.AddAuthorityFact(biscuit.Fact{Predicate: biscuit.Predicate{Name: "target_unrestricted"}})
 	if err != nil {
@@ -403,9 +403,12 @@ func createMockBiscuitToken(t *testing.T, peerID string, priv ed25519.PrivateKey
 		t.Fatalf("failed to add FactExpiration fact: %v", err)
 	}
 
+	if role == "" {
+		role = api.RoleRouter
+	}
 	err = builder.AddAuthorityFact(biscuit.Fact{Predicate: biscuit.Predicate{
 		Name: api.FactRole,
-		IDs:  []biscuit.Term{biscuit.String(api.RoleRouter)},
+		IDs:  []biscuit.Term{biscuit.String(role)},
 	}})
 	if err != nil {
 		t.Fatalf("failed to add role fact: %v", err)
diff --git a/tests/integration/multimaster_test.go b/tests/integration/multimaster_test.go
index 4b4bf62e..822803e0 100644
--- a/tests/integration/multimaster_test.go
+++ b/tests/integration/multimaster_test.go
@@ -279,9 +279,10 @@ func enrollClientOnControlPlane(t *testing.T, cpPort int, clientID peer.ID, pubB
 	t.Helper()
 
 	req := &api.EnrollRequest{
-		Jwt:       jwtToken,
-		PeerId:    clientID.String(),
-		PublicKey: pubBytes,
+		Jwt:           jwtToken,
+		PeerId:        clientID.String(),
+		PublicKey:     pubBytes,
+		RequestedRole: api.RoleNode,
 	}
 	reqBytes, err := proto.Marshal(req)
 	if err != nil {
diff --git a/tests/integration/proxy_test.go b/tests/integration/proxy_test.go
index 56afff77..b5085d45 100644
--- a/tests/integration/proxy_test.go
+++ b/tests/integration/proxy_test.go
@@ -16,6 +16,8 @@ package integration_test
 
 import (
 	"context"
+	"crypto/ed25519"
+	"crypto/rand"
 	"encoding/json"
 	"os"
 	"path/filepath"
@@ -47,13 +49,15 @@ func TestSamNodeRunWithStoredIdentity(t *testing.T) {
 		if err != nil {
 			return err
 		}
-		// The following constants are mock values used for testing.
-		// 'mock-biscuit-token' is a dummy token string.
-		// 'mock-hub-pub-key' is a dummy public key string.
-		if err := b.Put([]byte("identity_biscuit"), []byte("mock-biscuit-token")); err != nil {
+		pub, priv, err := ed25519.GenerateKey(rand.Reader)
+		if err != nil {
+			return err
+		}
+		biscuitBytes := createMockBiscuitToken(t, "12D3KooWRHDt3Ajd1t7YikBXyK2Uw1wrJwEX88XbwJhHh1XtBNkx", priv, "sam:role:node")
+		if err := b.Put([]byte("identity_biscuit"), biscuitBytes); err != nil {
 			return err
 		}
-		if err := b.Put([]byte("hub_public_key"), []byte("mock-hub-pub-key")); err != nil {
+		if err := b.Put([]byte("hub_public_key"), pub); err != nil {
 			return err
 		}
 		addrsData, _ := json.Marshal([]string{"/ip4/127.0.0.1/tcp/4002/p2p/Qm..."})
diff --git a/tests/integration/sambox_test.go b/tests/integration/sambox_test.go
index 2d4e4c03..8a0980c6 100644
--- a/tests/integration/sambox_test.go
+++ b/tests/integration/sambox_test.go
@@ -166,7 +166,7 @@ func TestSamBoxNanoInitIntegration(t *testing.T) {
 	_ = os.Remove("/tmp/ephemeral_ca.pem")
 	defer func() { _ = os.Remove("/tmp/ephemeral_ca.pem") }()
 
-	nanoInitCmd := exec.CommandContext(nanoInitCtx, nanoInitBin, udsPath,
+	nanoInitCmd := exec.CommandContext(nanoInitCtx, nanoInitBin, "run", udsPath,
 		"curl", "--cacert", "/tmp/ephemeral_ca.pem", "-s", "https://api.github.com/",
 	)
 	nanoInitCmd.Env = append(os.Environ(),