Define access
Under Infrastructure → Security and access → Access, choose a cluster and role (read-only, developer or admin) for a user or group, and list the allowed namespaces. Empty means the whole cluster.
Hiding
A user limited to certain namespaces sees only those in Kubernetes Explorer and kubectl; other namespaces, their objects and cluster-scoped resources are removed from lists and direct requests get “not found”.
API cache
Read answers are cached briefly and per user, identical concurrent requests reach the cluster once, and any write clears the cache for that path. Explorer marks cached answers “from cache”.
kubectl
whyctl login, then whyctl kube login <cluster>; kubectl works without a permanent kubeconfig, with the same namespace limits, and every request is audited.
WhyCloud users only
In each server’s or cluster’s access settings you can allow only organization members or its SSO users.