All
  Leaf query=data.authz_base.allow source=registered:authz-base
  Because reason="creating or modifying Kubernetes Services directly is not supported. Declare the port under spec.vmTemplate.services on the pool template, or PATCH spec.vmTemplate.services on your bound OSGymSandbox to expose it on a running sandbox; the matching Service is created for you."
    Leaf query=data.authz_k8s.not_direct_service_write source=multi["registered:authz","registered:authz-k8s"]
  Leaf query=data.authz_k8s.allow source=multi["registered:authz","registered:authz-k8s"]
  Leaf query=data.image_rollout.allow source=multi["registered:authz","registered:image-rollout"]
  Any
    Leaf query=data.authz_ownership.claim_allow source=multi["registered:authz","registered:authz-ownership"]
    All
      Leaf query=data.authz_ownership.probe_eligible source=multi["registered:authz","registered:authz-ownership"]
      Leaf query=data.authz_ownership.rbac_allow source=multi["registered:authz","registered:authz-ownership"] facts=namespace_rbac@registered-facts:namespace-rbac
  Because reason="A payment method is required to create this resource. Add one in Billing and try again."
    Any
      Leaf query=data.custom_resource_creation_admission.exempt source=multi["registered:authz","registered:custom-resource-creation-admission"]
      Leaf query=data.custom_resource_creation_admission.billing_eligible source=multi["registered:authz","registered:custom-resource-creation-admission"] facts=stripe_cards@registered-facts:stripe-cards facts=time@registered-facts:current-year facts=time@registered-facts:current-month
  Leaf query=data.image_admission.allow source=registered:image-admission body=1048576
  Leaf query=data.pool_admission.allow source=multi["registered:authz","registered:pool-admission"] body=1048576
  Because reason="a sandbox PATCH may only modify spec.vmTemplate.services (an optional metadata.resourceVersion precondition is also accepted)"
    Leaf query=data.sandbox_services_admission.allow source=registered:sandbox-services-admission body=1048576
  Because reason="vmTemplate.env and args on runtime kubevirt (the default runtime) need vmTemplate.processMode: Run, which also needs a command for args and single-line values; state runtime and processMode on a PATCH; processMode is Legacy or Run; env names must match ^[A-Za-z_][A-Za-z0-9_]*$."
    Leaf query=data.sandbox_process_admission.allow source=registered:sandbox-process-admission body=1048576
  Because reason="only tenant Secrets may be created through this API, in the path's namespace, with no generateName, annotations or ownerReferences. Claim secrets: a plain Opaque Secret named cua-claim-<name>, referenced from OSGymSandboxClaim spec.secretRef; Registry pull secrets: type kubernetes.io/dockerconfigjson named cua-registry-<name>, labeled cua.ai/registry-secret: \"true\", holding only .dockerconfigjson, referenced from vmTemplate.imagePullSecret."
    Leaf query=data.tenant_secret_admission.allow source=registered:tenant-secret-admission body=1048576
