# Separate the BYOC Customer Handoff and Account-Setup Profile

The canonical BYOC configuration separates the auditable customer product
contract under `byoc.customer` from the local execution credential under
`byoc.account_setup.profile`. The customer contract contains tenant and account
identity, Availability Zone names and IDs, TiDB CIDR, hosted-zone name/ID, PCA
ARN, and image-sync region; the deployment region remains `target.region`.
The account-setup profile is a local CP9 dogfood input that lets the operator
act as the customer to execute or validate the customer-side account setup. It
is never copied to the remote host or Kubernetes and is not available to DPM.

The existing `target.aws.iam.source_profile` continues to resolve to the CP9
control-plane account before CP9 assumes that account's `cp9-developer` role.
`byoc.account_setup.profile` must resolve to the distinct customer account.
CP9 rejects equal caller account IDs before mutation and binds both identities
to the session fingerprint. The two named profiles may reuse one underlying
IAM Identity Center/SSO session, but one final resolved profile cannot serve
both accounts. Customer runtime role ARNs are setup outputs recorded in the
resolved session, not arbitrary customer-handoff inputs.