Simulator

Simulator answers "what would happen if…" before anyone publishes. Pick a Role, a Connection and a Tool; for a cluster, type a Namespace; for a write, a Reason. Two answers appear side by side: by the draft in Policy, and by the version in force. Each says Allowed or Denied, the tier the target falls in and the rule that set it, whether personal values would be shown or masked, and the sentence a denied caller would read.

• A connection you have not added yet can be tried as "a connection on prod", on lower or on sandbox.
• The tools that write are in the list with the rest: a write needs the role's write grant on the target's tier, and on prod a Reason of at least eight characters.
• Where a product has no tool that reads personal data, "Any tool that reads personal data" stands in for one.
• Simulator runs the same decision the gateway and every agent run, so its answer is theirs.

Try it: choose Operator, a connection, kube_scale and the namespace production-payments, with a rule that makes production-* prod. The answer is denied: "Operator cannot act on prod…". Change the namespace to a staging one and it is allowed.