Identity and access
Browser sessions, scoped API/plugin tokens, project ownership checks, and separate operator capabilities.
Security
Boundaries you can inspect.
PlugLayer keeps authentication, ownership, deployment admission, routing, and operator actions in backend-owned workflows.
Workload isolation
Projects map to namespaces; compute placement and deployment resources are checked before rollout.
Network exposure
Public routes use managed TLS and access policies. Internal services can remain cluster-local without ingress.
Operations
Jobs, logs, audit records, backups, and security telemetry remain visible through typed workflows.