Tenancy

imp-sandbox supports two tenancy tiers on top of base Imp.

Tiers

• standard — namespace + NetworkPolicy isolation, gateway egress filtering.
• hard — strict isolation with Cilium enforcement (CiliumNetworkPolicy + CiliumExternalWorkload), per-sandbox token.

hard requires Cilium; see Sandbox Install — Cilium Requirement.

Choosing a Tier

Need	Tier
Trusted tenants, soft isolation	standard
Untrusted code, strict boundaries	hard (Cilium)

Mixing tiers in one cluster is supported — set per sandbox resource.