A team may scale only its approved Deployment from 2 to 8 replicas. A service backend can modify many namespaces. Two requests arrive with the same operation ID but different desired counts. Define authorization and concurrency behavior.

Resolve the approved target server-side, authorize team/action, enforce bounds and use scoped backend credentials. Bind operation identity to actor/target/parameters and reject conflicting reuse. Persist desired generation plus an outbox/intent atomically, apply with conditional resource version under a stated autoscaler ownership rule, and expose accepted versus applied state. The public Teleport SRE task supports adjacent API relevance, not this exact original design.