# Share Global CP and Isolate BYOC Regional and Dataplane Capacity

CP9 BYOC reuses the Dev full session's Shared cp9-global, creates a sibling BYOC regional control plane in `cp-byoc` rather than modifying `cp-premium`, and creates an independently isolated BYOC dataplane substrate. Every namespace-scoped regional service and its mutable configuration/state is a separate BYOC instance; BYOC requests never reuse the live `cp-premium` config-center, dataplane-manager, cluster-ng, executor, or TiCDC workloads. Cluster-scoped CRDs and controllers may be shared, but BYOC has a separate provider/runtime identity and ownership contract.

The proof uses two real AWS accounts: the CP9 target account hosts the remote session and BYOC regional control-plane network, while a distinct BYOC customer account hosts its session bootstrap, ECR, DNS, PCA, IAM, VPC, and dataplane EKS. The boundary must preserve independent naming, tagging, state, and cleanup while also exercising cross-account role assumption and PrivateLink principal authorization.