The backup lives in a realm the production token can't name

Ransomware on the app box is a token problem. Whatever runs there holds the automation token, and that token can delete the container and every snapshot on it. So the backup lives somewhere the token cannot address.

The production token is realm-restricted: realm_ids: ["<prod>"], allow_no_realm: false. It only works on https://<prod>.api.hoody.com, and reads there return only resources carrying that realm. The vault project belongs to a different realm. From production's side it is not hidden; it is unaddressable.

A cron in the vault container holds a token that belongs to both realms. Every night it runs POST /api/v1/containers/{app}/copy into the vault project and trims copies older than fourteen days. Realms are an API filter, not a firewall: and for this job, the API filter is exactly the boundary that matters.

The vault sees production. Production cannot see the vault.