How-tos

Map a private model service boundary

List allowed connections, distinct service identities, authorization rules, and a denied-access test before using real documents.