The collection name lives in your code, not in the policy. That is the whole mechanism. A grant attaches to a database, and there is nothing smaller to attach it to, so a role you wrote down as "write the events collection" is a role to write anywhere in that database [3]. Collection scoping is just a convention your own service happens to follow, not something the credential can see or enforce.
The boundary therefore holds for exactly as long as every write path in the pipeline is correct. Sakuda is blunt about what that is worth: he says the second named database, with the binding conditioned on the resource path, is the only place in the system where the security boundary is enforced by the platform instead of by his code being right [8]. A reviewer caught the original collection grant, and he calls it the single most useful piece of feedback he got [4].
Count what is left over. The post documents four failures: the collection grant, a design that pinned gemini-3.5-pro when the 3.5 family ships only as Flash and Flash-Lite [9], span markers that made the analyst model and the citation validator read different text [14], and fifteen synthetic essays that came out sounding like one writer [16]. Only the first had its remedy moved onto the platform, which leaves three sitting where they started [18].
The model pin is the clearest of the three. Pinning the Pro-tier model that does exist, gemini-3.1-pro-preview, satisfies the capability tier and fails the hackathon's Gemini 3.5-or-newer requirement [10], and that failure would not have surfaced until the first live API call, after the architecture was frozen [11]. He pinned gemini-3.6-flash and wrote a preflight that resolves every pinned model ID against the live catalogue and fails loudly [12]. That preflight is the same move as the second database. Both take a belief out of the author's head and hand it to something capable of contradicting him.
The essays make the point from the other direction. The spec called for fifteen generations in separate passes, none able to see another's output, never reconciled [15]. He got exactly that. All fifteen argued the same side, twelve of them used the phrase "a 2024 municipal broadband study" verbatim, which is 80 percent [16][17], and a twelve-word clause about a service appointment appeared word for word in the two essays meant to be the most stylistically distant [16]. A mechanism named after the property you want does not automatically deliver that property: fifteen passes run separately are not fifteen separate writers, and a collection scoped under one shared credential is not a separate trust domain.
One question the post leaves open decides whether the split transfers to your system: which principal is allowed to write the grades database. Every pipeline service account is denied [6]. Something has to be permitted, and by the rule that started this, that credential's reach is the grades database entire. Note also the provenance before you plan capacity around it. This is one developer's report from a hackathon build [1], not a docs citation, and it is the sort of claim worth reproducing against your own project.
