Operate
Security model
Assume tenants own root in their runners.
Trust boundary
Trusted control and storage services hold cloud and storage administration credentials. Tenants receive a scoped attachment only. Never put a platform API key, bucket key or ZFS administration credential inside a student runner.
Organization access
All resource lookups are organization-scoped. Browser sessions use a same-origin cookie and CSRF tokens for mutations. API keys are scoped to an organization, stored as hashes, and reveal their secret once. Owner and admin permissions govern keys, membership and billing.
Unqualified risks
Queued-write races, network partitions, memory pressure and independent-disk recovery are tracked qualification gates. Do not infer production safety from simulated backend tests or a successful guest flush alone. Review docs/qualification before enabling student access.