Tenancy

imp-sandbox supports two tenancy tiers on top of base Imp.

Tiers

• standard: namespace and NetworkPolicy isolation with gateway egress filtering.
• hard: strict isolation with Cilium enforcement (CiliumNetworkPolicy and CiliumExternalWorkload) plus a per-sandbox token.

hard requires Cilium. See Sandbox Install: Cilium Requirement.

Choosing a Tier

Need	Tier
Trusted tenants, soft isolation	standard
Untrusted code, strict boundaries	hard (Cilium)

You can mix tiers in one cluster. Set the tier on each sandbox resource.