Two admins, one permissions document, one rejected write

Two IT admins open the project's permissions document at 14:02. Both read file_version 17: the ETag. One adds a contractor group and PUTs with If-Match: file:v17. It lands; the document is now v18. The other, still editing v17, PUTs a minute later with the same header. Rejected. Their write would have silently erased the contractor group they never saw.

They re-read v18, reapply their change, PUT again. Forty containers now carry both edits, because the project-level document merges down into every container that doesn't override it.

Access policy for a fleet is usually a config repo with merge conflicts, or a console where the last click wins. Here the document has a version, every write names the version it read, and the API refuses a write that didn't.

The policy file can't be overwritten by someone who didn't read it first.