Long story but currently it's a mix of per team or per system accounts to have clean permission borders (so one team cannot touch another teams resources). Thou

Long story but currently it's a mix of per team or per system accounts to have clean permission borders (so one team cannot touch another teams resources). Though we also support account multi tenancy through scoped actions (tag or path based).