Tenancy Layout

A name prefix and an environment label are data every caller in the account can read or ignore; nothing enforces them. Isolation, quota and billing attach to the account, so only a separate account makes the split real.

Three symptoms matter: products contending for ceilings counted once for the whole account, a bill nobody can split by product, and a change or mistake in one product reaching the other two. Each follows from the account being one shared container.

A vended account arrives with its baseline already applied: audit and platform logs delivered to a central collection account, a private address range allocated from the organisation's plan, guardrail policies in force above it, and a named owner recorded.

A permission ceiling above the account subtracts from everything inside it. The effective permission is the intersection of the ceiling and the account's own grants, so an administrator can only grant within what the ceiling still leaves.

A preventive control refuses the call, so the disallowed state never exists. A detective control only records that it happened, leaving an exposure window and someone who must notice and undo it.

Policy travels down and charges travel up. A policy attached to a grouping node applies to every account in the subtree beneath it, while each account's metered usage rolls up into one consolidated bill at the root, still itemised per account.

The account is the container that owns resources, collects the bill and holds the quota pool. A sign-in identity is a principal acting inside that container. Resources belong to the account, so they outlive the identity that created them.

Paid twice: the network and baseline setup, the logging and monitoring wiring, every access grant, some per-account fixed charges, and every later change to all of it. Still single: the built artifact, the repository, the pipeline definition and the team.

Give the tree to the axis your mandatory restrictions are written in terms of, preferring the axis that changes least often. An account has exactly one parent, so only one axis can be the tree; the others survive as labels on accounts.

Everything the account contains: all three products' compute, storage and networks, the data the platform decrypts for account principals, the spending power of the single bill, and the audit record of management API calls itself, which the same rights can usually disable.

A template fires once, at creation, and stamps a copy; nothing links the account to it afterwards, so accounts diverge by vintage. Closing the gap needs a baseline version on every account, an idempotent re-apply, and controls inherited from above rather than copied.

Unowned accounts appear when vending has no decommissioning half: owners leave, projects end, and some accounts were never issued through the process at all. Close them by proving disuse from platform signals, quarantining reversibly, then closing and reclaiming what they held.

One account held both environments, so the job's filter rather than the platform decided what it could delete, and resources predating the label escaped that filter. Only a credential that cannot name production closes the route; an alert merely reports it.

It constrains management calls from the moment it is attached. Resources already running outside the approved regions keep running, surfaces with no region to test are untouched, and a workload copying data out itself is never evaluated by it.

A deny removes an action entirely; a required-property constraint leaves the action available but refuses any request that omits the property. Both are evaluated on the call, so neither can see what happens to the resource afterwards.

Two things change at once: the accounts inherit every policy attached above their new position, and their charges begin rolling up into your bill. Nothing inside them moves — resources, data and existing grants stay exactly as they were.

Mandate what cannot be retro-fitted, what fails silently, and what protects people outside the team; leave whatever varies with the workload. Every baseline item is owned forever, and a baseline heavy enough to be routed around stops being coverage at all.

Put a rule in the ceiling when the action is harmful the moment it happens and is expressible as a condition on the request. Leave it to detection when the harm is tolerable for the detection window or the rule needs facts the call does not carry.

Not migration — no resource moves. The cost is that every moved account's inherited policy changes underneath running workloads, the policies left behind silently cover fewer accounts, reporting built on the old shape breaks at the move date, and everything that assumed the old structure must be found.

A service both environments genuinely share belongs in neither: put it in a third account with every grant pointing inward — environments pull artifacts and append logs they cannot delete. A grant back out rejoins what you split.