Nix package definitions sit in a Git (or other VCS) repo, which you can access-control through your usual means. The binary artifacts are behind an HTTP server

Nix package definitions sit in a Git (or other VCS) repo, which you can access-control through your usual means. The binary artifacts are behind an HTTP server, which you can access control through whatever normal access control mechanisms, or leave uncontrolled and rely on the fact that it's not possible to retrieve artifacts from the server without having access to all the build inputs so you can hash them.