Postgres, Dragonfly, and NetworkPolicy must be provisioned by the platform admin or via itsh.dev dashboard, not by the tenant SA.