# WG Paid — multi-protocol access and quota model V1

## 1. Protocol catalog

Table `vpn_protocols`:

- `code`: wireguard, amneziawg, future values;
- display name;
- enabled;
- credential/config renderer version;
- server node/interface reference;
- capabilities metadata.

## 2. Per-grant quotas

Table `access_grant_protocol_limits`:

- access_grant_id;
- protocol_code;
- profile_limit;
- optional validity override;
- unique(access_grant_id, protocol_code).

Example:

```text
grant tester_v1:
  wireguard   3
  amneziawg   3
```

## 3. Profile counting

Quota counts active or provisioning connection profiles for the same user/grant/protocol.

Revoked profiles stop consuming quota after runtime disable is confirmed.

Failed provisioning must not create unlimited retry profiles; profile and operation are idempotent.

## 4. No cross-protocol concurrency enforcement

V1 explicitly does not:

- detect physical devices;
- merge WG and AWG usage;
- count simultaneous handshakes;
- disconnect the oldest protocol session;
- enforce a global session total.

This is a conscious product rule, not a missing technical feature.

## 5. Invite overrides

Invite can contain protocol limit rows that become grant limits after redemption.

Admin can later amend grant limits with audit.

## 6. Future payment plans

Plan defaults provide protocol quotas. Payment creates/extends grant while retaining active profiles within the new limits.

Quota reduction requires an explicit policy and must not silently revoke arbitrary profiles.