Function zone_allows_source_namespace 

pub fn zone_allows_source_namespace(
    zone: &DNSZone,
    source_namespace: &str,
) -> bool

Whether a DNSZone authorizes DNS records sourced from source_namespace.

A DNSZone in the same namespace as the source object (Ingress / Service / Route) is always authorized. A DNSZone in a different namespace must opt in via the ANNOTATION_ALLOW_ZONE_NAMESPACES annotation — a comma-separated namespace list, or the ALLOW_ZONE_NAMESPACES_WILDCARD *.

This mirrors the cross-namespace gate the DNSZone reconciler already enforces for instance targeting, and closes audit finding H1: without it, any tenant’s opted-in Ingress could publish records into any zone Scout served (a confused-deputy cross-tenant DNS hijack), because Scout writes with a cluster-privileged remote client.