Status: OUT
Container supply chain network isolation (ACR Premium → Private Link → AKS custom VNet) is a concrete instance of the platform-wide tier-cascading constraint model: ACR Premium gates private endpoints and content trust, AKS standard LB inherits zero-trust default-deny, and the compound tier requirements across both services demonstrate that multi-service deployment pipelines inherit the tier cascade at each service boundary.