if you want a truly and fully isolated permission system, you should run a different cluster to ensure physical isolation