two keys to touch anything live

The most dangerous capability in an orchestration platform is a command that reaches production, and the most dangerous version of that capability is one that is easy to run. Cluster submission tools are exactly that: a single verb away from scheduling work onto hardware that other people depend on.

The design put the live path behind two independent gates. The first is an explicit flag on the command, so nothing live happens by default. The second is a separate operator-written authorisation in the tool's own configuration area, which must say the live path is enabled and may additionally pin the address it is allowed to reach. Neither gate implies the other.

Ordering matters as much as the gates. The authorisation is read and the pin is compared before any client object is constructed and before any environment is consulted, so a refusal cannot be half a request. A pin that does not match refuses before the first packet leaves.

The third gate is the one that quietly earns its keep. Dry runs have to be provably offline, and the leak path was inherited environment: an operator shell, sourced for convenience, carries cluster addressing that any child process inherits. So the dry run scrubs that environment before it launches the validating step. A test suite that can dial production is a test suite that eventually will.

The cost is friction on every live action, plus a second file to keep honest.

What this proves: for irreversible operations the platform chose deliberate friction, and it treats "we proved it live" as a claim that requires an offline default underneath.