# Require Real Cross-Account BYOC Proof

CP9 BYOC requires two distinct resolved AWS accounts. The CP9 target account is the BYOC control-plane account; a separately selected customer account owns the session bootstrap and dataplane resources. Activation fails before mutation if the account IDs are equal. The core-lifecycle proof must exercise the production-like STS role assumption from the regional control plane into the customer account, reconcile customer resources only through that identity, authorize the control-plane runtime principal on the customer PrivateLink endpoint service, and create the consuming endpoint in the control-plane VPC. Resource isolation inside one account is not an accepted substitute because it cannot prove BYOC's primary authorization boundary.