The subsidiary rents the box, and the server answers only to the renter

The group is American. The subsidiary in Munich handles German customer data, and the transfer impact assessment keeps asking the same thing: who, in practice, can reach the machine?

The Munich entity's own Hoody account rents the server. Group IT is invited into the pool as Admin, which lets them view resources and manage members. Server commands are authorized on ownership, not pool membership: only the account that rents the machine can run them, and anyone else, Admin included, gets a 403.

So the parent can help operate. It cannot reboot, reimage, or command the hardware that holds the German data, because it does not hold the rental. The line between support and control is drawn by who pays for the box, and the API enforces it on every call.

Corporate structure becomes a fact about a rental, not a paragraph in a policy.