Run JaaS safely — tenant impersonation and RBAC, admission validation, network policy, and service mesh.