Multi-tenancy and scopes

The recommended boundary is one namespaced pipeline per team. KollectScope constrains allowed GVKs, namespaces, and sinks; admission and SubjectAccessReview checks enforce the boundary before collection begins. Watch labels provide an additional opt-in or opt-out filter, not an RBAC bypass.

Use a cluster-scoped resource only when cluster-wide ownership is intentional. Prefer workload identity and namespace-local references, and keep the operator's watched namespaces as narrow as the platform model permits.

At target reconcile, the scope checks the profile GVK and selected namespaces. At inventory reconcile, it checks every family-sink reference and applies the minimum export interval. A denial sets a stable Degraded reason and prevents that operation; it never widens the service account's permissions.

See ADR-0203, ADR-0205, and the production checklist.