 example, istio-ca-ns), which only cluster admins have access to.</p></li></ul><h3 id="example">Example</h3><p>Let’s consider a 3-tier application with three services: photo-frontend, photo-backend, and datastore. Photo-frontend and photo-backend services are managed by the photo SRE team while the datastore service is managed by the datastore SRE team. Photo-frontend can access photo-backend, and photo-backend can access datastore. However, photo-frontend cannot access datastore.</p><p>In this scenario, 