Two contractor firms, two passwords, one exit address

The state permitting portal allowlists one address: the agency's. Two contractor firms need to reach it from their own laptops, and the agency wants to cut either one off without touching the other, or the portal.

The container's egress service answers at its own URL and speaks plain HTTP proxy. The indexed hostnames egress-1 and egress-2 reach the same process and exit from the same address, but proxy permissions are evaluated per index. Group northfield gets a password on egress-1; group harbor gets one on egress-2. Each firm's laptops load a PAC file that returns HTTPS egress-N:443, and the portal side never changes.

Northfield's contract ends: delete their group. Harbor keeps working. The portal never learns anything happened.

No VPN concentrator, no client install, no allowlist change request that takes three weeks.

The exit is one address; the accountability is one index each.