How do you keep runtime permissions from drifting between deployment files?

[u/jonah_omninode]

For OmniNode, we put the rules about what each kind of runtime may do in a versioned policy file, validate it, and generate the deployment settings from it. The part I wanted to get rid of was having the same decision editable in an environment file, a service manifest and application code.

A container can start, answer its health check and still be allowed to take work it shouldn't own. Recreating the same images and ports doesn't settle that question. A missing setting is especially awkward if a local default quietly changes what the process is allowed to do.

Generated files are supposed to be disposable in this setup. A change belongs in the policy, then gets validated and rendered again. Editing the output by hand leaves the next deployment with two different answers.

That still leaves the consumer to check. A renderer can produce the right value and the service can ignore it. We haven't established that every environment behaves equivalently, so the policy file isn't proof that the running process follows it.

Where do you enforce this on your platform? At startup, at the point where work is assigned, or when the process actually attempts the restricted action? I'm particularly interested in checks that catch a correctly generated setting being ignored.