Interface IsolationPolicy

Denied targets for this resource boundary. Denials are additive across nested resources.

Declares which registered items are visible outside this resource's registration subtree.

• Omit exports => everything is public (default)
• exports: [] or exports: "none" => nothing is public
• Array entries must be explicit Runner definition/resource references

Allowed targets for this resource boundary. When provided, only these targets (and internal items) can be referenced.

Additional per-boundary grants for specific consumers.

whitelist can relax this boundary's own deny / only checks for the matching consumer-target relation, but it does not override visibility rules or restrictions imposed by ancestor resources.