One-way ejection: custody made explicit
Infrastructure products love the word ownership and often avoid its implications. The accounts and data are yours until you try to leave and discover that the operating credentials sit behind a support ticket and a retention call. Instaship makes the opposite mechanism part of the product. Every provider account it operates is customer-owned from day one. Complete a custody handoff and you receive the full operating credential bundle exactly once. Instaship then permanently stops reconnecting those accounts.
Custody that can silently revert is not custody.
Why workspace-level
Custody applies to the workspace, not one environment. Environments are disposable: they are minted, validated, and cleaned up. Provider accounts outlive any individual branch. Putting custody controls on an environment page would misstate that model. Cleanup belongs with environments; custody belongs in one deliberate workspace surface.
Why one-way
A reversible handoff would be a pause button, and both sides would treat it that way. Irreversibility makes the guarantee clear: your team can verify control instead of trusting a promise. It also keeps the product honest. Instaship must earn its place by remaining useful, not by retaining access to your accounts. There is no fee for leaving. A clean handoff is part of the product.