# Welcome to Omega Cloud (DRAFT)

You now have a private, isolated environment ("domain") on Omega Cloud. This
document explains what we manage, what you manage, and how we work together.

## What you received at handoff

- Your **domain**: a hard isolation boundary. Nothing you create inside it is
  visible to any other client, and no other client's activity is visible to you.
- Your **administrator account** (`<yourname>-domain-admin`): manages your
  team's users and projects inside your domain. This account and its scope are
  described in the Self-Service Guide.
- Two **workload accounts** (`-cluster` and `-svc`) preconfigured the way the
  platform requires -- see the Self-Service Guide before changing anything
  about them.
- A **capacity envelope (quota)** sized from your intake form.
- Access to shared platform resources: the external network for public
  connectivity, base operating-system and Kubernetes images, and a set of
  machine sizes (flavors).

## What we manage (and you cannot)

- The cloud infrastructure itself, including the isolation between clients.
- Your domain's existence, your administrator account, and password resets
  for it (there is deliberately no self-service recovery -- resets require a
  request from one of your named credential custodians).
- Quotas. Your administrator cannot raise them; an authorized requester asks
  us instead.
- The shared substrate: external networks, public base images, machine sizes.

## What you manage (self-service, no ticket needed)

Everything inside your domain: team user accounts, projects, private
networks and routers, firewall rules (security groups), virtual machines,
storage volumes, load balancers, Kubernetes clusters, application secrets
and certificates, and public IP attachments -- all within your quota.

## How to reach us

- Quota changes, password resets, custodian changes: request from an
  authorized requester (named in your intake form) via your account contact.
- Incidents/outages: your account contact, marked urgent.
- Everything else self-service: see the Self-Service Guide.

## House rules (the short version)

1. Never share account passwords between people; your administrator creates
   individual users instead.
2. Never ask us to grant "admin" on your accounts -- the platform will refuse,
   by design. Your `-domain-admin` account already has every right you need
   inside your domain.
3. Keep your two named credential custodians current with us.