I disagree. You can still apply rules to repo/image and have those descend to blobs, just as happens now. If you ask for a blob and have access to repo/image wi

I disagree. You can still apply rules to repo/image and have those descend to blobs, just as happens now. If you ask for a blob and have access to repo/image with that blob, you see it. Otherwise not.