Network access a service declares, not one it inherits

The problem

Hand-written network policies drift. Callers and the allow-lists of what they call are edited in different places, a copied rule grants more than intended, and a "temporary" broad rule becomes permanent because nobody can prove what removing it would break.

The approach

Every tenant namespace is deny-by-default. A shared dependency is a capability: a reusable component the namespace lists and a label the workload carries. The destination admits callers by that same label, so the two sides cannot drift apart. A destination only one workload uses, such as its own bucket, is a private numbered policy, so a label can never grant access to someone else's data.

Guardrails on the guardrails

Policies live in their own path, applied by a service account that can manage Cilium policies and nothing else. CI rejects world, cluster-wide or 0.0.0.0/0 allows, broad FQDN patterns, CIDR rules without ports, and the cross-namespace selector that silently means "this namespace only". Dropped flows are exported and alerted on, which turns a missing rule into a ticket instead of a mystery timeout.

What changed

Who may talk to whom became readable in one directory and reviewable in one pull request. Broad rules were removed only after real traffic showed the replacement covered every flow: parity first, removal second, evidence always.

Described as a pattern: names, numbers of systems and identifiers from the environments where this was built are left out.