#Resource Hierarchy

Every object in ByteOr Cloud belongs to a strict ownership tree. Understanding this tree is essential for RBAC scoping, API path construction, and lifecycle management.

#Ownership Tree

Organization
├── Project
│   ├── Environment
│   │   ├── Agent
│   │   ├── Deployment
│   │   ├── Pipeline Draft
│   │   ├── Pipeline Version
│   │   ├── Config Bundle
│   │   ├── Artifact
│   │   └── Approval
│   └── ...
└── ...

Deleting a parent cascades to all children. For example, deleting a project removes every environment, agent, deployment, and artifact under it.

#Deployment Status Lifecycle

A deployment moves through a linear pipeline with well-defined branch points for failures and rollbacks.

pending_approval ──→ approved ──→ building ──→ deploying ──→ active
       │                                          │
       ▼                                          ▼
     denied                                     failed
                                                  │
                                                  ▼
                                            rolling_back
                                                  │
                                                  ▼
                                            rolled_back

#Approval Status Lifecycle

Approval records track the human decision associated with a deployment.

pending ──→ approved
       ──→ denied
       ──→ expired
       ──→ revoked

#Asynchronous orchestration

Cloud uses asynchronous backend workflows for compilation, bundle preparation, deployment orchestration, artifact handling, and replay requests. Those implementation details are intentionally abstracted behind the public deployment and approval lifecycle shown above.

#Rate Limiting & Abuse Controls

ByteOr Cloud applies rate limits at several layers to protect shared infrastructure:

• Per-token rate limits — Bearer and agent key endpoints enforce sliding-window limits. The current budget is returned in X-RateLimit-Remaining and X-RateLimit-Reset headers.
• Enrollment throttle — Agent enrollment is limited per environment to prevent credential-stuffing.
• Payload size caps — Request bodies are capped at 4 MiB for API calls and 64 MiB for artifact uploads.
• Concurrent deployment cap — Each environment allows a configurable maximum number of in-flight deployments to prevent resource exhaustion.

Clients that exceed limits receive 429 Too Many Requests with a Retry-After header.

#Hosted Public Environment