diff --git a/README.md b/README.md
index 663b32c..5d81743 100644
--- a/README.md
+++ b/README.md
@@ -80,7 +80,7 @@ account**. That is why the GCP module's base grant includes
 `roles/iam.serviceAccountUser`, and why it asks for a project dedicated to Ringleader
 workstations. Check what your default compute service account holds (older projects give
 it `roles/editor`), or give workstations a role-less service account of their own — see
-[`gcp/README.md`](gcp/README.md#every-workstation-runs-as-a-service-account).
+[`gcp/README.md`](gcp/README.md#every-vm-ringleader-creates-runs-as-a-service-account).
 
 Letting Ringleader **create** those per-user identities and **bind roles** to them is a
 separate switch, `enable_workstation_identities`, and it costs real permissions: on GCP the
@@ -370,11 +370,17 @@ Each cloud's README lists the exact values. In short:
   created) subnet id.
 - **AWS** — role ARN, region, and (if created) subnet id and security group id.
 
-Each module also prints a **governed subnet id** where it created one. That is the subnet you
-name on a workstation that carries an **egress policy**. Placing a box in it is what puts it
-behind the proxy. On AWS and Azure, a box with no egress policy loses its egress if it shares a
-subnet the proxy steers. On those two clouds, each Ringleader namespace that runs its own proxy also
-needs a governed subnet of its own. Set `additional_governed_subnets` (`ADDITIONAL_GOVERNED_SUBNETS`
+The subnet, region, zone, network tags and security groups go on a CloudIdentity. That is the
+Ringleader object a namespace admin writes to say how the namespace's workstations run in your
+account. By default a namespace member cannot set these values on a workstation. Each cloud's README
+shows a CloudIdentity.
+
+Each module also prints a **governed subnet id** where it created one. In a namespace that runs a
+proxy, a namespace admin names it in the CloudIdentity for the workstations that carry an **egress
+policy**. Placing a workstation in it is what puts it behind the proxy. On AWS and Azure, a
+workstation with no egress policy loses its egress if it shares a subnet the proxy steers. On those
+two clouds, each Ringleader namespace that runs its own proxy also needs a governed subnet of its
+own. Set `additional_governed_subnets` (`ADDITIONAL_GOVERNED_SUBNETS`
 for `deploy.sh`) to create one for each further namespace. Terraform keys those ids by the labels
 you gave them, the Azure `deploy.sh` prints them, and CloudFormation outputs them by slot number.
 
diff --git a/aws/README.md b/aws/README.md
index bb5f61b..5562a6f 100644
--- a/aws/README.md
+++ b/aws/README.md
@@ -87,8 +87,7 @@ Everything else derives from those two:
 ## Pick a path
 
 Use whichever your team already runs. They create the same OIDC provider, role, and
-optional network, with one difference: the per-workstation instance-profile option
-(`enable_workstation_identities`, below) exists only on the Terraform path.
+optional network.
 
 ### CloudFormation (`aws` CLI)
 
@@ -144,6 +143,73 @@ pad's range, and the plan fails rather than guessing if they disagree. See
   becomes the `Storage` object's `spec.grant`, and on the named width
   **`artifact_storage_bucket`**, which becomes its `spec.bucket`
 
+### Setting these values on a CloudIdentity
+
+A CloudIdentity is the Ringleader object a namespace admin writes to say how that namespace's
+workstations run in your account. Its `spec.defaultProviderConfig` fills in a value a workstation
+leaves out, and its `spec.overrideProviderConfig` sets a value that wins over the workstation's own.
+By default a namespace member cannot set the region, subnet or security groups on a workstation, so
+they go here. With no `selector`, a CloudIdentity applies to every AWS workstation in its namespace:
+
+```yaml
+apiVersion: core.ringleader.dev/v1
+kind: CloudIdentity
+metadata:
+  name: aws
+  namespace: team-a
+spec:
+  provider: aws
+  cloudAccountRef: <your CloudAccount's name>
+  defaultProviderConfig:
+    aws:
+      region: us-east-1
+      subnetId: <subnet_id>
+      securityGroupIds: [<security_group_id>]
+```
+
+`cloudAccountRef` names the CloudAccount, the Ringleader object that holds the `target_role_arn`
+above.
+
+Each workstation takes its settings from one CloudIdentity: the one with the highest `priority`
+among those that select it. A workstation that carries an egress policy needs the group with no
+egress rules (`inbound_only_security_group_id`). Where its namespace runs a proxy, it needs the
+governed subnet too. For those workstations, write a second CloudIdentity with a higher `priority`
+that selects them by a label you choose. Repeat in it every value the first one sets apart from the
+subnet and the security group, because only one CloudIdentity applies:
+
+```yaml
+apiVersion: core.ringleader.dev/v1
+kind: CloudIdentity
+metadata:
+  name: aws-governed
+  namespace: team-a
+spec:
+  provider: aws
+  cloudAccountRef: <your CloudAccount's name>
+  priority: 10
+  selector:
+    matchLabels:
+      egress: governed
+  subnet: <governed_subnet_id>
+  defaultProviderConfig:
+    aws:
+      region: us-east-1
+      securityGroupIds: [<inbound_only_security_group_id>]
+```
+
+`spec.subnet` puts every workstation this CloudIdentity selects in that subnet. It also claims the
+subnet for the namespace, so Ringleader refuses another namespace's workstation there. Name the
+subnet in `spec.subnet` only, because Ringleader refuses a CloudIdentity that also names one in
+`defaultProviderConfig` or `overrideProviderConfig`. Never name the shared `subnet_id` in
+`spec.subnet`, since the claim would refuse any workstation another namespace places in it. In a
+namespace that runs no proxy, set `subnetId: <subnet_id>` under `defaultProviderConfig.aws` in place
+of `spec.subnet`.
+
+A workstation labeled `egress: governed` then takes these values. One that carries an egress policy
+without the label takes the first CloudIdentity's group, which permits egress. Ringleader therefore
+refuses to create such a workstation, as
+[Which security group a workstation gets](#which-security-group-a-workstation-gets) describes.
+
 ## Reaching your workstations
 
 | | needs | provided by |
@@ -391,9 +457,10 @@ ADDITIONAL_GOVERNED_SUBNETS=team-a=10.60.208.0/20,team-b=10.60.192.0/20 ./deploy
 
 Each entry becomes a subnet named `ringleader-governed-<label>`, built exactly like the governed
 subnet above. The label names the subnet and keys the `additional_governed_subnet_ids` output.
-Ringleader never reads it, so use the name of the namespace that will use the subnet. Set each id as
-`providerConfig.aws.subnetId` on that namespace's workstations that carry an egress policy, and on
-no other namespace's.
+Ringleader never reads it, so use the name of the namespace that will use the subnet. Name each id
+as `spec.subnet` in that namespace's CloudIdentity for its workstations that carry an egress policy.
+That claims the subnet for the namespace, so Ringleader refuses another namespace's workstation in
+it. [Setting these values on a CloudIdentity](#setting-these-values-on-a-cloudidentity) shows one.
 
 These subnets have no derived range, so write each CIDR out. In a first region, the six `/20`s from
 `10.60.128.0/20` to `10.60.208.0/20` are free and leave the workstations subnet room to grow to a
@@ -561,12 +628,13 @@ missing or is `None`, the subnet id or the region is wrong. The last command the
 even when something carries the group.
 
 If the last command lists nothing, nothing carries the group now. If it lists the instance of a
-workstation, that workstation has to move off the group first. Ringleader reads
-`providerConfig.aws.securityGroupIds` only when it creates a workstation. So create the workstation
-again with one of the two groups in
-[Which security group a workstation gets](#which-security-group-a-workstation-gets) in that field.
-Move anything else the command lists to a security group of its own. The commands list only what
-exists now, so make sure every workstation you create later names a security group too.
+workstation, that workstation has to move off the group first. Ringleader reads a workstation's
+`securityGroupIds` only when it creates the workstation. So name one of the two groups in
+[Which security group a workstation gets](#which-security-group-a-workstation-gets) as
+`securityGroupIds` in the CloudIdentity that selects the workstation. Then create the workstation
+again. Move anything else the command lists to a security group of its own. The commands list only
+what exists now, so make sure every CloudIdentity for workstations in this VPC names a security
+group too.
 
 To turn the switch on, set one variable and apply again:
 
@@ -773,11 +841,11 @@ default share it, so either one's role could pass the other's workstation roles.
 
 ## Workstations hold no AWS identity by default
 
-A workstation runs with **no instance profile** unless an administrator sets
-`providerConfig.aws.iamInstanceProfile`. Without that, nothing inside the workstation can act as any
-IAM principal. Attaching one needs `iam:PassRole`, which this module grants only when you
-set `enable_workstation_identities` (`EnableWorkstationIdentities` on the CloudFormation path) —
-read its warning first.
+A workstation runs with **no instance profile** unless a namespace admin names one as
+`iamInstanceProfile` in the CloudIdentity's `spec.overrideProviderConfig`. A workstation cannot name
+its own. Without one, nothing inside the workstation can act as any IAM principal. Attaching one
+needs `iam:PassRole`, which this module grants only while `enable_workstation_identities` is on, as
+it is by default (`EnableWorkstationIdentities` on the CloudFormation path).
 
 ## Notes
 
diff --git a/azure/README.md b/azure/README.md
index 2ffd9fb..e78c42d 100644
--- a/azure/README.md
+++ b/azure/README.md
@@ -242,10 +242,11 @@ first policy:
   only TCP 22 and 2222, and the group has no outbound rule. Such a workstation takes no other port
   from outside the VNet, even one your subnet NSG opens. Neither group admits anything the subnet
   NSG refuses, because both layers have to agree.
-- **A NIC NSG of your own is replaced, not merged.** A NIC carries at most one NSG. If you supply
-  the interface yourself (`providerConfig.azure.networkInterfaceId`) and narrowed inbound *there*,
-  Ringleader replaces that group when it creates the workstation, whether or not the workstation
-  declares `spec.egress`. With a policy, the replacement admits all inbound, so the subnet's rules
+- **A NIC NSG of your own is replaced, not merged.** A NIC carries at most one NSG. A namespace
+  admin can supply a workstation's interface as `networkInterfaceId`, on that workstation or on a
+  CloudIdentity that selects only it. If you narrowed inbound on that interface's NSG, Ringleader
+  replaces the group when it creates the workstation, whether or not the workstation declares
+  `spec.egress`. With a policy, the replacement admits all inbound, so the subnet's rules
   decide on their own, which **widens** inbound. Without one, it admits only TCP 22 and 2222 from
   outside the VNet. Move those rules onto the subnet NSG first. Ringleader adds a rule there, but
   never edits or deletes one you wrote.
@@ -414,9 +415,10 @@ ADDITIONAL_GOVERNED_SUBNETS=team-a=10.70.208.0/20,team-b=10.70.192.0/20 ./deploy
 
 Each entry becomes a subnet named `governed-<label>`, built exactly like the governed subnet above.
 The label names the subnet and keys the `additional_governed_subnet_ids` output. Ringleader never
-reads it, so use the name of the namespace that will use the subnet. Set each id as
-`providerConfig.azure.subnetId` on that namespace's workstations that carry an egress policy, and on
-no other namespace's.
+reads it, so use the name of the namespace that will use the subnet. Name each id as `spec.subnet`
+in that namespace's CloudIdentity for its workstations that carry an egress policy. That claims the
+subnet for the namespace, so Ringleader refuses another namespace's workstation in it.
+[Setting these values on a CloudIdentity](#setting-these-values-on-a-cloudidentity) shows one.
 
 These subnets have no derived prefix, so write each one out. In a first region, the six `/20`s from
 `10.70.128.0/20` to `10.70.208.0/20` are free and leave the workstations subnet room to grow. A
@@ -893,12 +895,68 @@ turn flow logs off in a shared group only when nothing else is using the zone.
 | **subscription id** | `az account show --query id -o tsv` |
 | **resource group** | the one you scoped |
 | **subnet id** (only if you created a network) | `terraform output handoff` |
-| **governed subnet id** (only if you turned it on) | `terraform output handoff` — `providerConfig.azure.subnetId` for the workstations that carry an egress policy |
+| **governed subnet id** (only if you turned it on) | `terraform output handoff`. It is the `spec.subnet` of the CloudIdentity for the workstations that carry an egress policy, where the namespace runs a proxy. See [Setting these values on a CloudIdentity](#setting-these-values-on-a-cloudidentity) |
 | **additional governed subnet ids** (only if you added them) | `terraform output handoff`, or printed by `deploy.sh`. One for each further namespace that runs a proxy, used on that namespace's workstations only. See [One governed subnet per namespace that runs a proxy](#one-governed-subnet-per-namespace-that-runs-a-proxy) |
 | **gateway subnet id** (only if you reserved one) | `terraform output handoff` — goes on the `Edge` as `spec.subnet`, not on a workstation; no gateway VM is built until it has one |
 | **`artifact_storage_grant`** (`managed` or `named`) | `terraform output handoff` — the `Storage` object's `spec.grant`, if you want payloads in a storage account of yours |
 | **`artifact_storage_account_name`** (named width only) | `terraform output handoff`, with the container Ringleader should write to. On the managed width Ringleader creates both itself |
 
+### Setting these values on a CloudIdentity
+
+A CloudIdentity is the Ringleader object a namespace admin writes to say how that namespace's
+workstations run in your subscription. Its `spec.defaultProviderConfig` fills in a value a
+workstation leaves out, and its `spec.overrideProviderConfig` sets a value that wins over the
+workstation's own. By default a namespace member cannot set the subnet on a workstation, so it goes
+here. With no `selector`, a CloudIdentity applies to every Azure workstation in its namespace:
+
+```yaml
+apiVersion: core.ringleader.dev/v1
+kind: CloudIdentity
+metadata:
+  name: azure
+  namespace: team-a
+spec:
+  provider: azure
+  cloudAccountRef: <your CloudAccount's name>
+  defaultProviderConfig:
+    azure:
+      subnetId: <subnet id>
+```
+
+`cloudAccountRef` names the CloudAccount, the Ringleader object that holds the app client id and the
+tenant id from the table above.
+
+Each workstation takes its settings from one CloudIdentity: the one with the highest `priority`
+among those that select it. Where a namespace runs a proxy, its workstations that carry an egress
+policy go in the governed subnet. For those workstations, write a second CloudIdentity with a higher
+`priority` that selects them by a label you choose. Repeat in it every value the first one sets
+apart from the subnet, because only one CloudIdentity applies:
+
+```yaml
+apiVersion: core.ringleader.dev/v1
+kind: CloudIdentity
+metadata:
+  name: azure-governed
+  namespace: team-a
+spec:
+  provider: azure
+  cloudAccountRef: <your CloudAccount's name>
+  priority: 10
+  selector:
+    matchLabels:
+      egress: governed
+  subnet: <governed subnet id>
+```
+
+`spec.subnet` puts every workstation this CloudIdentity selects in that subnet. It also claims the
+subnet for the namespace, so Ringleader refuses another namespace's workstation there. Name the
+subnet in `spec.subnet` only, because Ringleader refuses a CloudIdentity that also names one in
+`defaultProviderConfig` or `overrideProviderConfig`. Never name the shared workstations subnet
+in `spec.subnet`, since the claim would refuse any workstation another namespace places in it.
+
+A workstation labeled `egress: governed` then goes in the governed subnet, and one without the label
+takes the first CloudIdentity's subnet.
+
 ## Revoking
 
 - **Terraform:** `terraform destroy`.
diff --git a/gcp/README.md b/gcp/README.md
index 75c0b18..2b6a320 100644
--- a/gcp/README.md
+++ b/gcp/README.md
@@ -126,8 +126,10 @@ ssh_source_ranges = ["203.0.113.0/24"]   # the CIDRs your engineers connect from
 
 That creates one rule (`ringleader-allow-ssh`) targeting the `ringleader-workstation`
 network tag, so it applies to the VMs carrying that tag and nothing else. Ringleader puts the tag
-on a workstation that declares no `networkTags`. A workstation that declares its own list needs the
-tag in it (`providerConfig.gcp.networkTags: [ringleader-workstation]`).
+on a workstation when neither the workstation nor its CloudIdentity sets `networkTags`. A list,
+normally set on the CloudIdentity as
+[Setting these values on a CloudIdentity](#setting-these-values-on-a-cloudidentity) shows, must
+include the tag: `networkTags: [ringleader-workstation]`.
 
 Your rule keeps a workstation reachable from those CIDRs when Ringleader cannot write its own
 rule, in which case the workstation reports `SSHAdmissionMissing`. That happens, for example, when
@@ -146,16 +148,21 @@ secondary_ssh_source_ranges = ["203.0.113.0/24"]
 ```
 
 (or `SECONDARY_SSH_RANGES=203.0.113.0/24` for `network-landing-pad.sh`). That adds one rule,
-`ringleader-allow-secondary-ssh`, targeting the **`ringleader-secondary-ssh`** network tag — so it
-reaches only the workstations you tag with it. Put that tag on them **alongside** the first one:
+`ringleader-allow-secondary-ssh`, targeting the **`ringleader-secondary-ssh`** network tag, so it
+reaches only the workstations you tag with it. A namespace admin puts that tag **alongside** the
+first one, in the CloudIdentity that selects those workstations:
 
 ```yaml
-providerConfig:
-  gcp:
-    networkTags: [ringleader-workstation, ringleader-secondary-ssh]
+spec:
+  defaultProviderConfig:
+    gcp:
+      networkTags: [ringleader-workstation, ringleader-secondary-ssh]
 ```
 
-Replacing rather than adding would take TCP 22 away with it.
+A list without `ringleader-workstation` takes the workstations out of `ringleader-allow-ssh` and
+`ringleader-allow-internal`, the two rules that target that tag. When only some of a namespace's
+workstations need the port, give them a CloudIdentity of their own, as
+[Setting these values on a CloudIdentity](#setting-these-values-on-a-cloudidentity) shows.
 
 Leave `secondary_ssh_source_ranges` unset and it follows `ssh_source_ranges`, which is empty by
 default, so **no rule of your own is created**. Ringleader's own rule admits 2222 to its workstations
@@ -431,11 +438,10 @@ so the proxy has upstream egress with no further setup.
 
 ### GCP needs no subnet for the workstations that proxy governs
 
-A workstation is governed here by carrying a **network tag** — the same tag
-`providerConfig.gcp.networkTags` already sets — and an untagged workstation beside it is
-untouched. So the governed fleet needs no range of its own, and `create_governed_subnet` is
-**off by default** (it is on by default on AWS and Azure, where the steering attaches to a
-subnet instead):
+Here Ringleader governs a workstation by adding a **network tag** to it when it carries an egress
+policy. An untagged workstation beside it is untouched. So the governed fleet needs no range of its
+own, and no CloudIdentity of its own either. `create_governed_subnet` is **off by default**. It is
+on by default on AWS and Azure, where the proxy steers a whole subnet instead:
 
 ```hcl
 create_governed_subnet = true   # its range derives: the 15th /20 of network_cidr
@@ -654,9 +660,12 @@ inside whichever `/16` you gave it and clear of the two egress-control ranges at
 because both are regional and a subnet without them comes up unable to reach Ringleader.
 
 **Pin the proxy and the workstations it serves to the same zone.** Traffic between two VMs in
-one zone is free on GCP; same-region-different-zone is $0.01/GiB, charged to the sender. At 10
-TB/month that misplacement costs $100 — more than the `e2-standard-2` the proxy runs on. Zone
-is `providerConfig.gcp.zone` on the workstation.
+one zone is free on GCP, and traffic between two zones of one region costs $0.01/GiB, charged to the
+sender. At 10 TB/month that misplacement costs about $100, more than the `e2-standard-2` the proxy
+runs on. A namespace admin sets the workstations' `zone` in the CloudIdentity's
+`spec.defaultProviderConfig`, or in its `spec.overrideProviderConfig` so that it wins over a zone a
+workstation sets. [Setting these values on a CloudIdentity](#setting-these-values-on-a-cloudidentity)
+shows one.
 
 One trap worth naming: on GCP, *all* traffic to or from an **external** IPv4 address leaves the
 zone regardless of destination. So a workstation reaching its proxy by public address pays
@@ -793,6 +802,61 @@ Ringleader sets those itself, and a renamed tag is a rule that admits nobody.
 | **`artifact_storage_grant`** (`managed` or `named`) | the `Storage` object's `spec.grant`, if you want payloads in a bucket of yours |
 | **`artifact_storage_bucket`** (named width only) | that object's `spec.bucket`. On the managed width Ringleader names the bucket itself |
 
+### Setting these values on a CloudIdentity
+
+A CloudIdentity is the Ringleader object a namespace admin writes to say how that namespace's
+workstations run in your project. Its `spec.defaultProviderConfig` fills in a value a workstation
+leaves out, and its `spec.overrideProviderConfig` sets a value that wins over the workstation's own.
+By default a namespace member cannot set the subnet, zone or network tags on a workstation, so they
+go here. With no `selector`, a CloudIdentity applies to every GCP workstation in its namespace:
+
+```yaml
+apiVersion: core.ringleader.dev/v1
+kind: CloudIdentity
+metadata:
+  name: gcp
+  namespace: team-a
+spec:
+  provider: gcp
+  cloudAccountRef: <your CloudAccount's name>
+  defaultProviderConfig:
+    gcp:
+      subnetwork: <the subnet self-link>
+      zone: us-central1-a   # a zone in the subnet's region
+```
+
+`cloudAccountRef` names the CloudAccount, the Ringleader object that holds the target service
+account email and the workload identity provider from the table above.
+
+Each workstation takes its settings from one CloudIdentity: the one with the highest `priority`
+among those that select it. Some values belong on only some workstations, such as the
+`ringleader-secondary-ssh` tag. For those, write a second CloudIdentity with a higher `priority`
+that selects them by a label you choose. Repeat in it every value the first one sets, because only
+one CloudIdentity applies:
+
+```yaml
+apiVersion: core.ringleader.dev/v1
+kind: CloudIdentity
+metadata:
+  name: gcp-secondary-ssh
+  namespace: team-a
+spec:
+  provider: gcp
+  cloudAccountRef: <your CloudAccount's name>
+  priority: 10
+  selector:
+    matchLabels:
+      ssh-port: secondary
+  defaultProviderConfig:
+    gcp:
+      subnetwork: <the subnet self-link>
+      zone: us-central1-a
+      networkTags: [ringleader-workstation, ringleader-secondary-ssh]
+```
+
+A workstation labeled `ssh-port: secondary` then carries both tags. One without the label takes the
+first CloudIdentity's values.
+
 ## Revoking
 
 ```bash
diff --git a/gcp/terraform/README.md b/gcp/terraform/README.md
index 16d04b7..7b0257c 100644
--- a/gcp/terraform/README.md
+++ b/gcp/terraform/README.md
@@ -9,7 +9,7 @@ and a **secondary SSH port** only if you ask for one).
 The three roles are `roles/compute.instanceAdmin.v1`, `roles/compute.networkUser` and
 `roles/iam.serviceAccountUser`. The last one is required, not optional: every workstation
 VM runs as a service account (its own, or the project default compute one) and attaching
-one needs `actAs`. See [`../README.md`](../README.md#every-workstation-runs-as-a-service-account).
+one needs `actAs`. See [`../README.md`](../README.md#every-vm-ringleader-creates-runs-as-a-service-account).
 
 It declares **no provider block**, so you can reference it from your own
 Terraform. A ready-to-apply root is in [`examples/standalone/`](examples/standalone/).
@@ -28,9 +28,9 @@ Terraform. A ready-to-apply root is in [`examples/standalone/`](examples/standal
 | `enable_workstation_identities` | **`true`** | Let Ringleader **create** a per-user SA and bind roles to it (workstations run as a service account either way). Grants `roles/resourcemanager.projectIamAdmin`, which can grant any role in the project to anyone, including `roles/owner` to itself — the broadest grant here, and the reason this onboarding wants a dedicated project. Set `false` in a shared one. |
 | `create_network` | **`true`** | Create a VPC + subnet + Cloud NAT (egress out; inbound SSH from `ssh_source_ranges`, plus Ringleader's own rule for its workstations). Cloud NAT bills per hour and per GB. Set `false` if you already have a subnet. |
 | `ssh_source_ranges` | `[]` | CIDRs allowed to reach the VMs carrying `workstation_network_tag` on **TCP 22**. Empty creates **no rule of your own**. Ringleader writes its own rule admitting TCP 22 and 2222 from any address to the workstations it creates. Set this to reach other VMs, or to keep your engineers' CIDRs working when Ringleader cannot write that rule. |
-| `workstation_network_tag` | `ringleader-workstation` | Network tag the inbound-SSH rule targets; put the same tag on your workstations. |
+| `workstation_network_tag` | `ringleader-workstation` | Network tag the inbound-SSH rule targets. Ringleader puts `ringleader-workstation` on a workstation when neither the workstation nor its CloudIdentity sets `networkTags`. If you change this tag, or set a list, put this tag in the CloudIdentity's `networkTags`, as [Setting these values on a CloudIdentity](../README.md#setting-these-values-on-a-cloudidentity) shows. |
 | `secondary_ssh_source_ranges` | `null` | CIDRs for the **secondary SSH port** (TCP 2222) that some workstation types run their own SSH daemon on. Unset **mirrors `ssh_source_ranges`**. `[]` creates no rule for the port. You do not supply the port number. |
-| `secondary_ssh_network_tag` | `ringleader-secondary-ssh` | Network tag that rule targets. Put it on the workstations that need the port **alongside** `workstation_network_tag`, never instead of it. |
+| `secondary_ssh_network_tag` | `ringleader-secondary-ssh` | Network tag that rule targets. Put it in the `networkTags` of the CloudIdentity that selects the workstations needing the port, **alongside** `workstation_network_tag`, never instead of it. |
 | `name_prefix` | `ringleader` | Prefix for the landing pad's resource names. Change it only if those names are already taken in the project; the default reproduces the names this module has always used. |
 | `allow_internal_traffic` | **`true`** | Let workstations reach **each other** (tcp/udp/icmp from the workstation subnet ranges). The one default that widens rather than grants: `false` means a compromised box cannot scan its neighbours. Never admits anything from outside the subnets. It does not reach `<name_prefix>-allow-gateway`, which admits workstations to the egress gateway VM — that rule is what keeps hostname-level egress control working rather than a posture choice, so it follows no switch. |
 | `region` | `us-central1` | Region for the optional network's first subnet, router and NAT. |