I use multi-account containers too, and I like it. This is exactly my point, instead of mapping each domain into a single container, any domain could exist in

I use multi-account containers too, and I like it. This is exactly my point, instead of mapping each domain into a single container, any domain could exist in one or more "trusted tuples" Maybe another way to think of it is like a one-to-many join. A domain would not "belong" to a single container, but have tags to associate with 1+ containers.