Chapter 27 - Worked Answers

1. Absent versus explicit context

Selected records whether the private context key exists. Matches returns true for any object namespace when no explicit selection exists, allowing internal inventories. With an explicit default selection, it compares normalized namespace and limits visibility to default. HTTP middleware supplies explicit selection, so a context.Background internal call is not equivalent to an authenticated HTTP request. Tests must preserve that distinction.

2. Forbidden versus absent

A principal with only a team-a role selecting team-b can fail authorization before object lookup and receive forbidden. A request authorized within explicit team-a that uses a team-b object ID reaches the namespace match and returns not-found. Authentication and malformed names can fail still earlier. Vary one layer at a time in a fixture; otherwise a denial does not prove the intended scoped lookup was exercised.

3. Secret reference scope

Service creation checks namespacedKey(team-b, secret-name). A team-a record cannot satisfy it, so the missing local reference returns invalid state rather than decrypting or borrowing the other record. Ordinary assignment later resolves using the same workload namespace. The executed fixture tests this with disposable values. It establishes logical reference isolation, not independent agent/host memory or physical storage isolation.

4. Destructive rollback and physical limits

The down migration deletes non-default services, tasks, deployments, events, audit rows, secrets and registry credentials plus related service versions before dropping namespace columns. It cannot preserve both teams’ data under old global uniqueness. Require a backup/restore plan and explicit data-loss review; the chapter does not execute that downgrade. Even a correct logical namespace model leaves shared workers, Docker authority, networking and physical volume naming as separate trust boundaries.

These answers use chapter 27 and its scoped claim/execution records. Design changes remain proposals until separately implemented and tested.