Compartments

Wall a group of keys off from the rest of your account: choose One compartment when you make a key at API keys. A key in a compartment sees and uses only the sandboxes, snapshots, images, volumes, previews, ports and jobs its compartment's keys made; everything else answers "not found", and no other key reaches in except an account-wide one. Give one to each customer of your platform, or to an agent whose sandboxes nobody else may touch. Each compartment has its own sandbox names, so every customer can have its own main (compartments).