One permissions document governs forty containers

The platform team runs a project called internal-tools. Forty containers live in it, owned by eleven teams. Nobody on the platform team has opened most of them.

One PUT /api/v1/projects/{id}/proxy/permissions sets the rule for all forty: an ip group for the office range, a jwt group for operators, default: deny. Every container in the project inherits it. The forty-first container, created Tuesday, gets the same gate Tuesday, with no ticket and no review. A container that needs an exception carries its own document, which overrides the project's for that container only.

The old version was a VPN, a bastion, and a spreadsheet of who holds keys. The new version is a JSON file at one URL, enforced at the proxy in front of every terminal, file browser, and port.

The policy is a document, and the container is born inside it.