[nadaverell]

Deletion previews could expose resources the caller cannot read and present topology management links as guaranteed cascading deletion. Cached network-policy annotations could also retain evidence from hidden policies.

The preview checks permission to read the requested root, including case aliases such as Secret, before traversing the cached graph. It then uses the existing per-user graph projection so only visible related resources are returned. Permission-aware bounded neighborhoods withhold policy annotations whose supporting evidence is outside the authorized traversal, and filtering copies shared maps before editing them.

The dialog describes possible relationship impact. A failed request has a neutral unavailable note; a successful empty preview adds no blanket warning. Nonempty lists explain that they describe visible relationships rather than a deletion forecast. Namespace deletion explicitly warns that the namespace and its contents will be deleted, independent of topology.

The response shape and delete operation are unchanged. This PR does not classify garbage-collection ownership, propagation, finalizers or controller pruning; that remains a separate design. Review the denied-root/hidden-descendant cases and full → limited → full cache isolation.

Validation: complete application builds and TypeScript checks, focused sensitive-root handler regressions, topology/context race suites and the combined PR composition. Rendered checks cover real nonempty and Namespace previews, plus injected empty and HTTP-503 states. All dialogs were cancelled. No cluster permissions changed.

Request failure:

Successful empty preview:

Namespace deletion:

[cursor]

Bugbot needs on-demand usage enabled

Bugbot uses usage-based billing for this team and requires on-demand usage to be enabled.

A team admin can enable on-demand usage in the Cursor dashboard.