Isolation
One network per tenant, one policy per tenant
Networks, subnets, routers and ports belong to a project, and overlapping addressing between projects is expected rather than a problem. Address ranges are classified as private or routable, so routing and policy do not have to guess which a workload is. Sharing a network with another project is an explicit permission, not an accident.
Isolation is a property of the model, not a convention.
Routing
Routing happens where the workload is
Traffic between your own workloads is forwarded on the node that hosts them, instead of being sent to a central gateway and back. External traffic is served by a set of gateway nodes, with the active path chosen by a liveness protocol rather than by a manual failover. Address resolution and assignment run on the compute side, so tenant services do not depend on one control node.
No central hop for traffic that stays inside your estate.
Policy
Stateful policy, evaluated per connection
Rules are checked against connection state, so return traffic is admitted by the same decision that admitted the connection. Policy attaches to the port and is evaluated in the forwarding pipeline, so it does not need a separate firewall process per instance. Default is deny; what is allowed is written down.
Every allowed flow can be traced to the rule that allowed it.
Application layer
Policy that knows what the workload is, not just where it is
Workloads are grouped by identity derived from labels, and that identity travels with the packets. Policy therefore survives an address change, a reschedule, or a rebuild. Rules can match method, path, call name, header or domain, so an egress restriction can be written against a service rather than against an IP range.
Application-layer rules are enforced on the same path that forwards the packet.
Physical fabric
Tenant prefixes reach the fabric without static routes
Tenant network prefixes are announced to the physical routers, so external systems can reach a workload directly, per tenant, in its own forwarding table. Routes learned from the fabric are injected back into the virtual topology, so the two directions agree. Equal-cost paths and a liveness protocol give the fabric a defined failover, and reflection keeps the control plane flat as the number of speakers grows.
The virtual network and the physical network share one set of routes.
Observability
Flows are attributable
Flow records carry workload identity and labels, not only addresses, so a record means something without a lookup table. Denials are recorded with the rule that produced them. Visibility is collected at the datapath and aggregated across nodes over an authenticated, mutually verified channel.
You can show which rule admitted or dropped a flow, and from which workload.
Multi-site
Sites connect through routes, not through one shared network
Each site keeps its own topology. Prefixes are advertised and learned between them through a transit router, so cross-site reachability does not require static configuration on both ends. Identity-based policy is defined per workload, so the same rule applies in either site.
Cross-site reachability is a routing decision, not a flat network.
Guarantees
The datapath is not a bottleneck you have to design around
Forwarding, policy lookup and service load balancing run in the kernel path; only traffic that needs application-layer inspection leaves the fast path. The datapath can be offloaded to hardware where the estate supports it, and bandwidth and packet-rate floors can be set per port rather than only ceilings.
Guarantees are set per port, and enforced in the forwarding path.
