►
Description
Want to view more sessions and keep the conversations going? Join us for KubeCon + CloudNativeCon North America in Seattle, December 11 - 13, 2018 (http://bit.ly/KCCNCNA18) or in Shanghai, November 14-15 (http://bit.ly/kccncchina18)
SAFE WG Intro – Jeyappragash J J, padme.io, & Ray Colline, Google (Any Skill Level)
About Jeyappragash
Jeyappragash previously built the team and lead the technical roadmap for Twitter's Cloud Infrastructure Management Platform. This platform helps developers manage their services and provides detailed visibility to the infrastructure and the services that use the infrastructures. Prior to this he was a Distinguished Engineer at Motorola (then Google Company), leading efforts to build their Notification Infrastructure, their Software Upgrade services and a Prospective Search based Content Delivery Service and built a true hybrid infrastructure while migrating these services to Google cloud. Jeyappragash graduated from IIT Madras with a Masters in EE. He holds 5 patents in cloud infrastructure and distributed systems space.
About Ray
Ray has a diverse background with over 25 years of experience including 10+ years of system administration and site operations experience and 10+ years in software development. Ray loves to learn and explore new spaces from being an IT admin for the Paul Merage School of Business, to startups in the early 2000s and now 14 years at Google where he has worked on enterprise focused software, android nfc payments, networking and Google Cloud Platform.
Ray is passionate about the operations and administration user experience and wants to make it easy for administrators to say yes to their customers needs without sacrificing the integrity of the systems they are responsible to protect.
Join us for KubeCon + CloudNativeCon in Barcelona May 20 - 23, Shanghai June 24 - 26, and San Diego November 18 - 21! Learn more at https://kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy and all of the other CNCF-hosted projects.
A
B
A
To
start
a
working
group
with
the
CNC
F
to
cover
the
end-to-end
security-
and
this
is
like
the
first
of
the
presentations
that
we've
hired-
and
this
is
like
really
really
really
at
the
beginning
stages
of
what
this
working
group
is.
We've
done
a
lot
of
work,
we'll
go
through
some
of
them
right
now
in
terms
of
where
we
are
and
I.
C
C
C
C
You
know,
charter
and
laying
out
laying
out
the
group
and
we're
on
our
way.
Through
the
you
know,
discovery
and
requirements,
gathering
process
and
inviting
participation
there
and
then
I'm
gonna
move
on
to
the
next
slide,
where
we'll
kind
of
see
these
the
roadmaps
of
the
steps
that
we're
going
through
a
little
bit
more
visually.
And
if
you
talk
about
some
of
the
concrete
things
that
the
safe
working
group
is
is
working
through.
C
C
We're
gonna
move
into
a
phase
of
building
out
the
understanding
of
the
existing
standards,
working
on
some
common
definitions
and
delivering
a
you
know,
standards
in
practice.
So
we
can
have
that.
You
know
real-world
system
architecture.
You
know
in
a
shared
perspective
and
then
phase
four
we're
gonna,
identify
and
you
know
catalog
some
of
some
of
these
projects
and
identify
some
of
the
gaps
in
in
the
systems.
So
we
can
come
and
deliver
our
final
recommendation
so
we're
you
know
bringing
to
the
TOC
a
working
group
proposal.
So
we
can
go
and
deliver
this.
C
They
were
not.
You
know,
looking
to
choose
any
single
technology
or-
or
you
know,
to
be
a
standards
body,
but
we
absolutely
want
to
inform,
engage
their
folks
across
all
the
CNCs
projects
and
make
sure
that
we're
you
know
looking
beyond
kubernetes
through
Cloud
Foundry,
and
you
know
then
serverless
so
we're
incorporating
all
those
use
cases-
and
you
know
users
of
the
system.
You
know
know
that
they're
safe.
C
D
C
D
When
you
think
about
safe,
you
know
we
talk
about
access,
but
access
is
something
that's
can
be
a
lot
of
things
construed
as
access
control,
so
our
back
and
kubernetes,
and
things
like
that,
but
there's
actually
much
more
to
it,
and
this
is
something
that
we
want
to
explore
because
we
see
out
there
in
in
in
the
industry
that
a
lot
of
these
things
that
control,
whether
you
can
do
something
or
not
are-
are
developed.
Orthogonal
E.
So
things
like
quota
things
like
Network
policy
access
control
policies.
D
A
B
Okay,
good
hello,
everyone,
I'm
mocchi
midi
and
I'm
the
product
lead
for
Identity
and
Access
Management
for
Cloud
Foundry
I
work
for
pivotal
and
I
also
lead
the
Identity
and
Access
Management
offerings
at
pivotal,
so
yeah
I've
been
a
part
of
for
the
say
for
working
group
since
its
inception
work
working
very
closely
with
dan
and
JJ
and
others
on
defining.
First
of
all,
the
personas
that
we
are
catering
to
with
this
working
group.
So
I,
you
know
like
yesterday,
I
was
thinking
about
okay.
B
A
B
D
B
I
thought
about:
okay:
let's,
let's
start
by
defining
what
are
the
key
goals
of
each
of
the
broad
persona
categories
that
sit
within
the
enterprise.
The
first
and
the
foremost,
obviously
is
the
security
team
and
their
Charter
is
basically
that
all
of
the
platform
be
it
like
on
premise
or
in
the
cloud.
The
apps
and
the
data
is
kept
secure
at
all
the
times.
But
then
that
is
not
enough,
because
you
know
like
in
a
typical
enterprise
or
it
could
be
a
government
agency.
B
You
are
always
dealing
with
with
compliance
and
showing
or
proving
that
you
are
secure
at
all
the
times
and
that's
where
compliance
plays
like
a
huge
role.
So
they
want
to
make
sure
that
compliance
is
is
met
at
at
all
levels
and
all
the
applicable
regulations
are
met.
Then
come
the
operators
who
actually
have
to
realize
the
goals
which
have
been
set
out
by
the
security
team
and
the
main
choice
is
basically
as
us
as
an
Operations
team.
B
Then
come
the
developers
or
the
development
team
who's,
whose
main
task
obviously
is
to
build
applications
that
deliver
business
value,
but
but
that
at
the
core
of
that
is
again,
you
know
like
doing
things
again
in
a
secure
manner.
So
any
application
or,
if
API,
that
the
development
team
is
putting
out
that
delivers.
Some
kind
of
business
value
has
to
again
adhere
to
all
of
the
security
sort
of
best
practices
set
out
by
the
organization
and
then
finally,
the
end-users,
who
are
actually
realizing
some
kind
of
business
value
through
the
applications.
B
But
again
they
should
be
able
to
access
the
data
and
the
resources
that
are
set
forth
by
the
applications
in
in
a
frictionless
manner
and
in
a
secure
manner.
But
the
thing
is
organizations
today
are:
you
know
like
on
a
journey
towards
making
everything,
either
containerized
running
in
different
clouds
accessing
data
in
different
clouds.
B
So
you,
you
are
looking
at
doing
these
things
and
achieving
these
goals
in
a
multi
cloud
manner,
and
that's
where
the
complexity
is
because
with
every
cloud
comes,
it's
sort
of
like
own
set
of
like
access
criteria
and
security
policies
that
you
have
to
adhere
to
and
you
have
to
interoperate
so
it
it.
You
know
like
it,
starts
off
as
like
a
simple
goal,
but
then
it
becomes
a
very
complex
goal
to
achieve.
B
So,
let's
unpack
that
a
bit
in
in
a
in
a
security
team
like
I
mean
I
I,
don't
have
to
iterate
all
of
this,
but
like
as
an
info
suck
team,
you
are
basically
laying
out
best
practices
for
a
security
of
data
at
rest
and
in
motion.
So
you
are
looking
at
laying
out
guidelines
for
how
authentication
is
done.
How
do
you
identify
a
user
or
a
system?
It
could
be
an
application
or
an
API.
B
How
do
you
perform
access
control
so
that
you
are
giving
access
only
to
the
authorized,
some
Jex
and
then
network
security
as
well,
because
you
want
to
make
sure
that
all
all
access
is
happening
in
a
secure
fashion
at
a
network
layer?
So
you
have
to
think
about
like
firewall
rules
and
network
segmentation,
and
then
you
also
have
to
make
sure
that
all
all
access
is
audited.
Everything
is
logged.
You
have
to
be
aware
of.
B
You
know
like
what
kind
of
cryptographic
algorithms
you
are
using
for
your
encryption
and
other
activities
like
signing
the
the
packets
or
the
data
that
is
flowing.
You
have
to
care
about,
like
data
loss,
prevention,
metrics
monitoring
and
then
also
other
sort
of
process.
Things
like
penetration
testing
dependency
scanning.
So
these
these
are
the
typical
things
that
an
InfoSec
team
cares
about
from
a
safe
working
group
perspective.
B
We
are
very
much
interested
actually
in
in
the
authorization
the
access
control
at
all
layers,
not
not
just
at
a
network
layer
but
flowing
all
the
way
through
to
layer.
Seven
now,
as
I
as
I
mentioned
before
compliances
is
another
angle
to
it.
You
have
to
prove
that
you
are
secure,
so
that's
where
you
know
you
have
to
start
proving
that
okay.
So
if,
if
it
is
someone
in
the
financial
space
or
the
financial
vertical,
you
have
to
prove
PCI
compliance.
B
If
you
are
in
the
federal
space,
you
have
to
prove
FISMA
now
the
latest
one
or
to
join
the
compliance
boat
is
gdpr
and
soon
it
will
be
enforced.
And
now
you
have
to
comply
with
gdpr.
So
as
as
a
compliance
as
someone
on
the
compliance
team
you're
dealing
with
compliance
with
those
regulations,
you're
dealing
with
auditing
access,
auditing
resource
usage,
I'm
sure
everyone
has
heard
about
certifying
access
on
a
regular
basis.
B
You
have
to
audit
changes
that
you
are
making
to
the
different
policies
and
to
configurations,
and
then
you
also
have
to
identify
violations
to
the
policies,
especially
any
violations
to
segregation
of
duties.
So
that's
that's
sort
of
like
a
picture
of
what
what
the
security
team
is
responsible
for
then,
the
the
guidelines
that
are
laid
by
the
security
team
have
to
be
enforced
by
the
operators
and
and
the
other
personas.
B
So
when
we
were
thinking
about
operators,
we
we
sort
of
split
it
into
three
buckets
so
to
speak,
to
capture
all
the
different
varieties
of
operators
in
an
enterprise
and
what
kinds
of
tasks
they
have
to
perform.
So
we
have
an
enterprise
operator.
I
have
bucketed
security
administrators
also
under
that,
because
they
perform
similar
actions.
So
it
could
be
an
operator
responsible
for
a
certain
security
setup
or
configuration.
We
have
the
Kota
operator
and
the
network
operator.
B
So
as
an
enterprise
operator
dealing
with
our
cloud
resources,
you
are
basically
responsible
for
resource
administration
and
you're,
also
responsible
for
compartmentalizing
resources.
What
that
means
is
you
have
to
deal
with
like
essentially
tenancy
and
making
sure
that
you
know
you?
You
are
providing
access
or
delegating
access,
only
under
a
given
namespace
or
under
a
given
tenant.
So
you
are
you're
doing
that
delegated
access
so
that
you
like
you,
you
can
delegate
out
the
roles
and
responsibilities
in
a
secure
manner
and
you
by
yourself.
B
You
are
not
acting
like
a
super
user
doing
everything,
but
you
are
enabling
other
operators
within
the
team
to
perform
a
subset
of
those
actions
over
a
subset
of
the
resources.
You
are
also
dealing
with,
or
tracking
changes
that
are
happening
to
resources.
You
you
have
to
assess
policy
change
implications
as
well
anytime.
You
make
a
change
in
access
it.
Those
are
big,
sweeping
changes
that
affect
you
know
like
what
teams
have
access
to
and
what
they
can
do
within
a
given
cloud
or
within
a
given
context.
B
So
you
have
to
make
sure
that
you're
making
the
right
policy
changes.
So
assessment
of
policy
changes
is
really
important.
As
with
any
organization
you
you
always
have
to
like
there,
there
are.
There
are
going
to
be
some
exceptions,
so
you
have
to
track
those
carefully
and
then.
Finally,
you
you
are
also
responsible
for
monitoring
the
send
the
resources
that
you
are
responsible
for
so
another
another
classification
of
the
operator
as
the
quota
operator,
who
is
responsible
for
managing
resource
kotas.
B
So
this
is
to
make
sure
that
you
know,
like
each
team
or
like
a
line
of
business
within
a
given
enterprise.
Is
is
being
allocated
cloud
resources
based
on
their
needs
and
based
on
the
organization's
policy?
I
mean
we.
We
don't
want
like
AWS
bills,
going
into
like
millions
of
dollars,
which
typically
it
does
happen
so
usage
tracking
is,
is
really
important.
You
know
you,
you
want
to
track
usage
of
resources
like
at
an
org
level.
B
At
a
team
level,
you
want
to
have
alerts,
put
alerts
for
overage
again,
you
want
to
track
changes
that
you
are
doing
to
management,
and
then
you
want
to
delegate
out
these
photo
management
activities
as
well
and
then
finally
assess
changes
to
quota.
Then
comes
the
network
operator
network
operator
in
a
in
a
you
know.
An
enterprise
is
typically
responsible
for
administering
again
firewall
rules
or
firewall
policies.
Administering
network
segmentation
delegating
out
you
know
like
set
up
related
activities
to
other
network
operators
downstream
and
assessing
changes
so
sort
of
moving
on
there
are.
B
There
are
other
key
personas
that
we
have
to
care
about
in
an
enterprise
when
it
comes
to
security.
It
is
it
as
the
developers
because
our
developers
at
the
end
of
the
day
are
actually
going
to
deal
with
implementing
security
within
the
application.
So
when
I
say
developers,
I'm
actually
looping
in
a
lot
of
the
operational
pieces
as
well,
and
it's
not
necessarily
that
it's
the
developer,
doing
the
tasks
that
are
defined
here,
but
based
on
the
cloud
that
you
are
and
the
kind
of
products
that
you
are
using
it,
it
might
be.
B
Some
responsive
might
be
of
the
platform
and
some
responsibilities
might
life
with
the
developer
themselves.
So
as
a
developer,
delivering
application
security,
you
are
tasked
with
sort
of
end
user
access.
So
you
are,
you
have
to
define
how
end-users
and
systems
will
authenticate
and
authorize,
and
you
are
again
doing
this
in
a
hybrid
environment.
So
if
it
was
all
of
homogeneous
environment,
it's
it's
still.
B
You
know
like
easy
to
define
a
security
policy
and
to
actually
achieve
achieve
it,
but
it
becomes
complex
when
you
are
dealing
with
a
hybrid
environment,
and
you
have
you
know,
legacy
systems
or
legacy
apps
which
are
potentially
sitting
outside
or
forgiving
cloud
context,
and
they
have
to
access
resources
or
a
apps
or
API
is
within
within
a
cloud
platform.
How
is
that
done
in
a
secure
manner?
You
have
to
deal
with
services,
databases
any
other
value-added
services
in
the
cloud
that,
like
your
app
needs
to
interact
with?
B
How
is
that
set
up,
and
how
is
that
made
possible?
And
you
also
have
to
deal
with
other
services
that
you
would
be
accessing
so
authorization
is.
Is
that
like
it's?
It's
it's
a
continuum
like
II.
There
is
like
coarse-grained
authorization.
Then
there
is
fine-grained
authorization
which
goes
all
the
way
into.
You
know
like
a
given
context
and
a
given
resource
context
and
a
given
environment
context,
so
it
can
get
fairly
complex,
so
they
also
have
to
deal
with
fine-grained
authorization,
related
rules
and
policies.
B
B
You
know
like
a
consumer
application.
So
at
the
end
of
the
day,
it's
all
about
the
kind
of
data
that
you're
accessing
and
as
an
end
user.
You
care
about
data
privacy
and
making
sure
that
you
know,
like
your
data,
is
not
compromised
in
an
enterprise
set
up
your
from
an
end-user
policy
perspective.
You
want
to
make
sure
that
authorized
users
have
access
to
the
data,
but
the
end-users
themselves
may
be
requesting
access
or
to
more
applications
or
data,
or
they
could
be
further
delegating
access.
B
So
those
are
things
that
we
we
should
be
carrying
about,
that
they
are
done
in
a
secure
manner
and
they
also
have
to
understand
the
implications
of
any
sort
of
access
or
changes
that
happen,
and
they
might
be
instigating
those
so
as
an
as
an
end
user
I
want
to
request
access
to
applications
or
I
want
to
revoke
access
for
certain
applications
over
my
data.
It
should
be
possible,
though,
so
that
these
are
the
personas
that
we
have
come
up
with
I
I,
don't
believe
by
any
means
that
this
this
is
like
a
done
task.
B
We
want
to
work
more
closely
with
with
the
working
group
and
have
like
more
participation
further
from
the
community
and
and
understand
sort
of
like
what's
what's
happening
within
within
enterprises
and
within
your
communities,
and
what
kinds
of
use
cases
you
are
seeing
so
would
be
very
open
to
sort
of
improve
this
further.
That's
it
from
my
side
today.
A
B
D
All
right,
well,
hi
everyone,
so
I'm
ray
Kali
and
I
actually
have
worked
on
the
cloud
resource
manager,
product
on
Google
cloud
platform
and
I'm
thinking
a
lot
about
policy
and
kubernetes
these
days.
But
when
I
came
to
safe,
I
and
started
I
wasn't
part
of
the
original
crew,
but
I
came
on
a
few
months
ago,
and
this
this
space
interested
me
a
lot
because
in
my
previous
positions
we
we
really
cared
about.
D
These
are
the
people
responsible
for
certifying
systems
for
keeping
them
safe,
to
be
able
to
say
yes
to
their,
you
know
to
their
CIOs
and
to
their
constituents
that
this
system
is
safe,
that
the
system
actually
does
what
we
intended
to
do
and
I
can
prove
it
and
when
I
make
a
change,
I
can
understand
what
I'm
doing
and
I
can
still
certify
it.
So
we
thought
a
lot
about
this
and
we
created
a
document
called
the
administrators
Bill
of
Rights
co-worker
of
mine,
Cyrus
harf
Arsuf.
D
So
in
a
way
you
know
when
we
think
about
administrators,
it's
like
well,
who
are
they
right?
Well,
they're
there
anyone
responsible
for
any
sub
segments
of
the
system.
Anyone
who
can
grant
access
to
someone
is
an
administrator
right
and
in
organizations
they
tend
to
be
a
you
know,
many
ways
they
tend
to
be
hierarchical,
but
they
just
tend
to
have.
You
know
many
different
levels
of
administration's
from
the
very
top.
You
know
the
security
avenues,
doing
the
whole
system
down
to
a
developer
who
gives
access
to
their
neighbor
to
access
this
this
app.
D
So
it's
a
set
of
principles
and
requirements
for
policy
and
resource
management
systems.
It's
defined
in
a
public
document
which
is
linked
here
and
it
focuses
on
owners
of
infrastructures
primarily
and
not
developers,
but
actually
I,
think
it
focuses
on
all
personas.
Anyone
who
grants
access
to
something
is
covered
by
the
Bill
of
Rights
and
I
think
using
it
we
can
quickly
evaluate
existing
access
management
systems.
So,
with
that
said,
let's
actually
get
into
what
these
rights
are.
So
we'll
start
with
the
first
right,
which
is
essentially
administrated
Minister
their
organization's
cloud
resources.
D
So
if
we
dig
into
that,
what
does
that
mean?
It
means
that
I
can
see
everything
like
I'm
at
the
top.
I
have
root
access
to
my
organization.
I
can
find
and
discover
everything
that
I
have
access
to
and
that
there
isn't
shadow
IT
and
that
some,
and
that
is
some
owner
of
a
system
below
me,
can't
take
me
out
and
say
sorry.
You
can't
see
this,
and
this
is
important,
because,
if
I
can't
see
something,
I
can't
actually
know
about
it
and
I
can't
certify
it.
D
The
second
thing
is:
is
audit
all
accesses
and
understand
the
policy
grants.
So
what
does?
What
does
it
rate
have
access
to?
What
does
JJ
have
access
to
in
this
system?
Right,
that's
a
first-class
thing
we
need
to
do.
We
call
it
explain
ability
as
another
way
to
think
about
this
and
it's
the
idea
that
I
can
understand
and
ask
a
question
of
the
system,
and
it
will
give
me
an
answer
such
that
I
can
feel
confident
about
that,
and
so
this
is
actually
challenged
in
many
systems.
D
It's
it's
the
more
knobs
and
and
and
controls
that
you
let
administrators
to
find
access
to
the
harder.
It
is
to
explain
what
happens
when
you
turn
that
knob
so
being
able
to
give
the
people
the
ability
to
Aude
it
both
who
has
access
to
what
and
who
made
an
access.
Change
is
a
key
right.
The
third
one
might
seem
a
little
odd,
which
is
I
could
delete
my
clot
resources,
and
this
gets
back
to
access
as
an
administrator.
D
If
something
is
going,
haywire
I
need
to
be
able
to
push
the
big
red
button
that
say
stop,
and
so,
if
I
don't
have
access
to
lis
or
when
I
go
to
deleted,
it
says
sorry,
you
have
to
delete
33
other
things
in
order
to
delete
this,
that's
a
problem.
So
in
these
systems
we
should
be
able
to
have
a
way,
for
you
know,
someone
who
has
access
to.
Actually,
you
know
follow
through
with
being
able
to
turn
something
off.
D
The
fourth
which
which
sri
mentioned
abate,
is
compartmentalized
organizations
resources,
and
this
is
how
you
can
scale.
So
if
you
have
rude
on
something
and
you
have
5,000
people,
you
have
to
be
responsible
for
you
don't
want
to
be
the
single
bottleneck.
You
want
to
be
able
to
identify.
Other
admins
in
the
system
and
say
you
have
domain
over
this
set
of
resources.
This
compartment
of
resources-
and
importantly,
you
know
we'll
get.
D
This
is
another
sub
right
which
is
I,
can
do
everything
that
you
can
on
my
sub
set
of
resources
right
and
I
can
control
when
I
want
you
to
have
to
escalate
right,
but
I
should
not
be
forced
into
escalating
certain
escalating
for
certain
things.
I
should
be
able
to
delegate
everything,
and
this
gets
the
next
one,
which
is
delegation
all
right.
Clearly,
we
want
to
be
able
to
act
over
the
compartment
that
we
created
and
then
I
want
to
be
able
to
act
autonomously.
So
this
means
I
have
full
control.
D
So
all
three
of
these
rights
kind
of
relate
to
each
other
and
what
we
find
out
in
systems
is
that
delegation
is
possible,
but
it's
not
really
full
delegation,
it's
missing
a
set
of
features,
and
so
therefore,
it
makes
it
hard
to
actually
autonomously
act
on
that
compartment.
Okay,
so
an
important
thing
here
is:
when
I
make
a
compartment
and
I
say:
okay,
here's
this
thing:
okay
ray
you
can
go
administer
this
thing.
D
D
You
can
create
a
namespace,
but
when
you
create
this
namespace,
you
can't
do
the
following
things
and
that
allows
me
to
certify
system
to
say:
yes,
it's
self-serve,
so
it's
efficient
and
people
can
go
ahead
and
start
working,
but
I
also
can
say
that
I
know
they're
not
going
to
do
very
bad
things
and
so
constraining
is
is
key.
Well
any
time
you
constrain
someone
someone's
gonna,
raise
their
hand
and
say
well
wait,
but
I
have
a
special
use
case.
How
do
I?
D
You
know,
how
do
I
do
that,
and
so
making
exceptions
is
at
the
core
and
actually
a
lot
of
systems,
because
they
can't
make
exceptions.
We
end
up
with
over
grants
and
we
end
up
with
things
that
are
either
people
say.
Look
it's
just
too
much
administration
for
me
to
be
bottle,
not
good
for
everything
or
fine.
You
can
just
do
it
and,
and
they
make
they
open
up
their
systems
wider
than
they
want
to
simply
to
over,
to
deal
with
the
burden
of
not
having
to
deal
with
exceptions.
D
So
exceptions
is
a
key
part
of
delegation
and
then
the
other
thing
is
is
that
I
want
to
be
able
to
evolve
this
over
time?
We
might
reorge.
We
might
decide
that
today
we're
vertically
integrated
and
now
we
want
to
be
horizontally
integrated,
and
so
we
want
to
separate
a
database
out
of
an
application
and
move
that
over
to
a
different
team.
So
can
I
evolve?
D
Can
I
actually
take
resources
and
take
things
and
create
a
new
compartment
from
where
there
wasn't
one
in
the
past
and
then
give
it
all
the
benefits
of
that
lots
of
systems
don't
allow
this
right.
Even
GCP
itself
has
limitations
in
this
in
this
area,
where
you
can't
move
stuff
out
of
projects
per
se,
and
then
lastly,
I
want
to
be
able
to
exercise
all
of
these
rights
and
I
want
to
be
able
to
do
it
in
a
hybrid
and
multi
cloud
way
right.
D
So
the
things
we
want
to
come
up
with
here:
we
need
to
be
open
and
need
to
be
able
to
be
implemented
across
many
clouds
and
don't
involve
proprietary
definitions.
So
that's
a
really
quick
overview
of
what
the
the
Bill
of
Rights
are.
We
hope
that
within
safe,
this
helps
us
inform
decisions
and
we
can
test
recommendations
against
these
proposals,
which
is
why
we're
starting
here
and
it
helps
us
really
think
about
personas
and
what
they
need
and
hopefully
through
that
we
can
get
to
the
next
phases,
as
dan
has
indicated
here.