{
  "observed_at": "2026-09-12",
  "guide_path": "/guides/business-vpn-vs-remote-access",
  "formula": "cell = stored support state when the control key exists; unknown if business_controls key missing or control key missing; missing business_controls is unknown not unsupported; missing control key is unknown for that control not a product-wide no; plan_dependent is not a universal yes; object-level plan_dependent is not a cell value; a consumer VPN is not private-resource access; a documented public_internet_egress yes is not a consumer country-picker VPN; NordLayer Lite shared gateway is not private-resource access; Twingate Exit Networks are not on Teams; stored SSO yes on Teams is Google Workspace not Okta; stored audit_logs yes is vendor logging not an inspected SOC 2; same class is not a ranking; counts are integers not billed totals",
  "count_formula": "private_resource 3+1=4; device_posture 3+1=4; access_policies 3+1=4; public_internet_egress 3+1=4; sso 4+0=4; personal_unknown+business 12+4=16; nordlayer_seats 5≠1",
  "office_formula": "office_pass = business_remote_access AND private_resource_access_yes; unknown cannot satisfy; plan_dependent is not a universal yes; a consumer VPN is not private-resource access",
  "team_formula": "team_pass = business_remote_access AND private_resource_access_yes AND sso_yes AND mfa_yes AND device_posture_yes AND audit_logs_yes; unknown cannot satisfy; plan_dependent is not a universal yes; a consumer VPN is not private-resource access",
  "hand_arithmetic": [
    {
      "product": "private_resource",
      "yes_count": 3,
      "plan_dependent_count": 1,
      "classified_sum": 4,
      "note": "3+1=4. Tailscale, Twingate and Cloudflare One document yes. NordLayer Lite shared gateway is plan_dependent, not private-resource access."
    },
    {
      "product": "device_posture",
      "yes_count": 3,
      "plan_dependent_count": 1,
      "classified_sum": 4,
      "note": "3+1=4. NordLayer Device Posture Security is an add-on on Core."
    },
    {
      "product": "access_policies",
      "yes_count": 3,
      "plan_dependent_count": 1,
      "classified_sum": 4,
      "note": "3+1=4. NordLayer access policies start beyond Lite."
    },
    {
      "product": "public_internet_egress",
      "yes_count": 3,
      "plan_dependent_count": 1,
      "classified_sum": 4,
      "note": "3+1=4. Twingate Exit Networks are not on Teams. A documented yes is not a consumer country-picker VPN."
    },
    {
      "product": "sso",
      "yes_count": 4,
      "not_yes_count": 0,
      "classified_sum": 4,
      "note": "4+0=4. Stored SSO yes on Teams is Google Workspace, not Okta."
    },
    {
      "product": "family_split",
      "personal_missing_controls": 12,
      "business_count": 4,
      "classified_sum": 16,
      "note": "12+4=16. Missing business_controls is unknown, not unsupported. A consumer VPN is not private-resource access."
    },
    {
      "product": "nordlayer_seats",
      "nordlayer_minimum_seats": 5,
      "standard_minimum_seats": 1,
      "note": "5≠1. Seat floor, not a billed total."
    }
  ],
  "assumptions": [
    "A consumer VPN is not private-resource access.",
    "Missing business_controls is unknown, not unsupported.",
    "Missing control key is unknown for that control, not a product-wide no.",
    "plan_dependent is not a universal yes.",
    "Object-level plan_dependent is not a cell value.",
    "Unknown cannot satisfy a hard requirement.",
    "A documented public_internet_egress yes is not a consumer country-picker VPN.",
    "Stored audit_logs yes is vendor logging, not an inspected SOC 2.",
    "Counts are integers, not billed totals.",
    "Same class is not a ranking.",
    "ACSC Using VPNs (October 2021) is organisational, not a consumer product list."
  ]
}