Request a sandbox, get a URL, nobody files a ticket

An engineer opens the internal portal and clicks "new sandbox." Nine seconds later a URL appears. No IT human was involved.

The button hits an exec script IT wrote once. The script calls POST /api/v1/containers/{golden_id}/copy with source_snapshot set to the current hardened baseline and the requester's name in the container name. The new container lands in the sandboxes project, whose project-level permissions already say office-IP-only and default: deny, so it's governed before anyone sees it. The script creates a proxy alias with expires_at thirty days out and returns it. The requester gets a terminal, an editor, and a filesystem they own until the alias dies.

Forty sandboxes a week. Idle ones cost nothing on the flat-rate boxes IT already rents. Expired ones get deleted by a weekly cleanup. IT's involvement is the script, the baseline, and the monthly resource page.

Self-service used to mean a form. Now it means an endpoint.