Students log in with the university's own token

Campus SSO already issues a JWT in a cookie. The course project gets one permission group: type jwt, the university's RS256 public key, source cookie:session, required claim course: cs101. Default policy: deny. The group is granted code and terminal; everything else in the container stays closed.

Every service in every container is a URL behind the same proxy, so that one document covers all forty machines. A student opens their editor URL; the proxy reads the cookie, checks the claim, lets them in. A student who dropped the course gets a 403 the moment the registrar updates the claim. Nobody created a Hoody account, nobody emailed a password, nobody holds an SSH key.

At term end, the instructor deletes the group. The containers stay, the door closes.

Three hundred students, zero accounts created, one rule at the proxy.