The first time you see Mosh tag-based resource access control in action, it feels like cheating.
No roles to juggle. No nested permission trees to untangle. Just clean, precise control that scales from a single server to thousands of dynamic assets—because the access logic lives in the tags, not in brittle permission code.
Tag-based access control flips the old list-and-role model on its head. Instead of binding resources to static roles, every resource gets one or more tags that define its identity, purpose, or sensitivity. Users, processes, and services are matched to those tags in real time. The result: simpler policies, faster changes, and fewer security holes hiding in the cracks.
With Mosh, tags are first-class citizens. You can create, update, or revoke access in seconds without pushing new code. Need to pull audit logs for every "finance-sensitive"service in production? It’s one rule. Need to lock down all "beta-feature"endpoints for a single customer group? Another single rule. The complexity is gone, but the power stays.
This approach isn’t just about simplicity. It’s about agility in systems where resources are ephemeral, names change, and endpoints appear or vanish without notice. Mosh doesn’t need to know the names—it only needs the tags. A container spins up with the right tags; access control policy applies instantly. One goes offline; nothing else changes.