Only the pool owner can put money on the bill

IT runs the engineering pool: three servers, one owner, two admins, forty users. Users deploy containers. Admins add and remove members. Only the owner can rent a server into the pool.

Renting is the one thing on this platform that costs money. Containers are free inside the server. So are snapshots, cron entries, daemon programs; bandwidth and storage come with the listing. The forty Users can create as much as the hardware allows and the bill doesn't move. The two admins can reorganize the whole team and the bill doesn't move. Exactly one account can make it move, and that account belongs to the person who holds the budget.

Cloud IAM gets to this shape with a policy per service: deny this call here, allow that one there, audit it quarterly. Here the shape is the role table.

Spend authority is a pool role, and one person holds it.