Memory-safe core, your identity provider, real RBAC, no inbound holes into the management plane.
Operations, alerts and monitoring share one timeline, so a 3am failover reads as a sequence with causes — not four tabs you correlate by hand.