Six boundaries, six layers that hold them

When the CLI called cloud provider tools directly, credentials leaked into its environment and no audit trail recorded what it did. Provisioning answered with six hard boundaries, each enforced at six independent layers.