"Each namespace/identity has its own L7 proxies; no multi-tenant proxies"></a></div><figcaption>Each namespace/identity has its own L7 proxies; no multi-tenant proxies</figcaption></figure><p>In ambient mode, we do not share L7 processing in a proxy across multiple identities. Each identity (service account in Kubernetes) has its own dedicated L7 proxy (waypoint proxy) which is very similar to the model we use with sidecars. Trying to co-locate multiple identities and their distinct complex policies and cus