Your customer's agent can't list your other customers

You sell agents that manage infrastructure. Each enterprise customer's agent creates containers, snapshots them, reads logs. It holds a Hoody API token to do that. The question every buyer asks: what happens when that token leaks?

Each customer is a realm. Their token is restricted to it and can only call the realm-scoped host, {realmId}.api.hoody.com. That host returns only resources carrying the realm ID. A leaked token lists the customer's own containers and nothing else, because the API doesn't deny the others, it omits them. Enumeration returns an empty list. Writes land inside the realm automatically.

Permission checks say: it exists, you can't have it. A realm says nothing. Combined with one container per customer underneath, the agent's whole world is the customer who pays for it.

To the wrong token, the other customers don't exist.