The plan is a quota on a project the customer can't leave

You sell sandboxes: Starter gets 3, Team gets 25. The plan lives in your billing table, and enforcement lives in a check you wrote and hope every code path calls.

Here each customer is a realm and a project you pre-create with max_containers: 3. Hoody enforces the quota at container creation: the fourth create returns PROJECT_CONTAINER_LIMIT, whichever path asked for it. The customer's token is minted with permission_template: external_customer, which denies projects.create, billing, AI, and server management, and allow_no_realm: false, so it only works on {realmId}.api.hoody.com. They can fill their project. They cannot make another one.

Upgrade to Team is updating the project's max_containers to 25. Downgrade is the same call the other way. The plan and its enforcement are one object.

Entitlement stopped being a check your code runs and became a number on the project.