Scope cordons context, too
In samcloud, scope decides what you can see and what you can do. Groups hold machines and services, and every person or agent is an owner, editor or viewer in each group. There’s no difference between an agent and a person: you’re admin or you’re not.
That lets you shape a whole team: - an agent that only sees the work machines; - an agent that uses a sibling’s services without being able to change the sibling’s environment; - one admin agent that can go anywhere.
It piggybacks on ordinary sysadmin behaviour. I’m not inventing new kinds of container, and I’m not sitting between agents and the computers they use.
Scope also cordons context. An agent only sees the tickets, docs and threads in its groups, so it isn’t wading through everything else.
What scope doesn’t do is guard a service’s own front door. samcloud routes; each service decides its own login. A DNS provider doesn’t decide whether your website has a password. It just gives it an address.