The outsourced dev shop works inside a realm you can see

You hired a four-person shop in another timezone to build the billing module. You don't want them near the rest of the system, and you don't want to be their full-time supervisor either.

They get a realm with its own auth tokens: delegated access for an external party, scoped to exactly the containers that are theirs. Inside it, they work however they like. From outside it, you open a read-only share of any terminal session and watch, or read the session history after the fact. You snapshot their container before each weekly review.

When the module ships, you delete the realm's tokens. Their access ends; the code stays on your server.

Delegation without blindness: they get a realm, you keep the view.