@Joey continuing my thinking from before... tell me if this seems insane, but I was think our authz proxy keeps a record of

serviceaccount

and

prefix

objects, and binds service accounts to be readers/writers on prefixes. Does this seem a sensible way of authorising the proxying