The source-address critical option is an SSH access-control setting that allows authentication only from approved client IP addresses or CIDR ranges. It is typically carried in server-side permissions data and checked during login, so a request from an untrusted network should be rejected before the session is established.
This matters because it adds a network-based trust boundary to SSH, which is often used for administration, automation, and bastion access. In real attacks, an implementation bug or missed callback path can cause the rule to fail open, letting disallowed clients continue into password, keyboard-interactive, or other authentication flows. Defenders use it to reduce exposure, but it should be paired with firewalls, VPNs, and jump hosts, since access controls are only effective when every login path enforces them consistently.