When a platform offers no named space, a team's isolation is a name prefix plus the grants written against it — how far does that hold?

## Convention is not enforcement Where a platform provides a first-class **named space**, membership is a property the platform holds: a stream is in the space or it is not. Where it provides none, teams fall back on **a name prefix** — everyone agrees that a team's streams begin with an agreed string — and back it with **grants** written against that string. The difference is not cosmetic. In the second case the platform knows nothing about teams, prefixes or boundaries; it knows how to compare characters at the start of a name when a rule says to. The convention is a document. The grants are the boundary. That is why the honest answer to *how far does it hold* is: as far as the grant set covers it, and not one character further. ## The four conditions 1. **Grants must be expressible against the prefix.** Some platforms let a rule name a prefix or pattern; others only an exact stream name. Where only exact names can be granted, every new stream needs a new rule, and the boundary becomes a process that a busy week can skip. 2. **Creation must be constrained too.** Teams reliably write rules for reading and writing and leave creation broad. An unconstrained create right lets any principal place a stream under another team's prefix, where it inherits that team's grants and any budget attached to the prefix. 3. **No broader rule may overlap.** A pattern that matches everything, or an administrative grant issued for an incident and never withdrawn, reaches inside every prefix. Nothing announces this; the convention still reads correct in the document. 4. **No prefix may begin another.** Prefix matching has no notion of word boundaries, so a rule granted on `pay` also matches `payments`, `payroll` and `pay-archive`. The two teams look separate on paper and are not. ## What the prefix never covers - **Client identities.** Principals and credentials are not stream names and do not live under anyone's prefix. - **Named reader state.** On platforms where a group of readers shares one stored position, that name is usually held in its own flat space, and platforms differ on whether a rule can be written against it at all. - **Cluster-level operations.** Anything addressed to the cluster rather than to a stream sits outside every prefix by construction. - **Quota attachment.** Where a ceiling cannot be attached to a name pattern, it attaches to a client identity or to nothing finer than the cluster, and per-team budgeting stops following the prefix. | | First-class named space | Prefix plus grants | |---|---|---| | Membership | A property the platform holds | A string comparison at rule-match time | | A stream outside the boundary | Cannot be created inside it by accident | Is an ordinary valid name, silently outside | | Overlapping boundaries | Impossible between two spaces | Happens whenever one prefix begins another | | Rule maintenance | One rule per space | One rule per pattern, if patterns exist | | What is still shared | Everything physical | Everything physical | ## The mis-scoped name The characteristic failure is small and quiet. Someone creates a stream a character off the agreed prefix — a typo, a singular where the convention is plural, an environment segment left out. Nothing rejects it, because nothing validates the convention; the cluster sees a perfectly ordinary name. The stream works. It carries real records. And it sits outside the grants written for that prefix, outside any budget attached to it, and outside every listing anyone runs by prefix. It is discovered when someone else cannot read it, or when a review notices bytes that belong to nobody. The repair is not a stricter document. It is to make the grant set the thing that carries the rule: constrain the create right to the prefix as well as read and write, so a name outside the prefix cannot be created by the team that is supposed to own it. What remains uncovered — overlapping prefixes, rules issued above the convention — is an audit problem, and the audit has to be run against the grant set rather than the naming standard. ## What this does not buy you A prefix boundary, like a first-class space, scopes names, grants and quota attachment. It still scopes nothing physical. Two teams separated by an immaculate prefix convention share every disk, every cache, every request thread and every failure of the same nodes. Tightening the convention improves who can reach what; it never improves what happens when the cluster has a bad day.