...
Additional isolation and execution-environment sandboxing can be supported depending on the Control Loop Element Type. For example: ONAP policies for given Control Loop Instances/Types can be executed in a dedicated PDPsPDP engine instances; K8S-hosted services can executed in isolated namespaces or in dedicated clusters; etc..Sandboxing using an API gateway is implemented in the Participant Intermediary. In order to remove the possibility for Participant Implementations to access and configure the API gateway, the Participant intermediary handles interaction with the API gateway.
4.4 Security and Multi Tenancy
...