A cross-zone isolation bypass exists in the global control plane due to how resources are attributed during the zone-to-global KDS sync. The system uses the sender-controlled `ControlPlane.Identifier` instead of the authenticated zone identity derived from the connection. This allows an authenticated zone to inject, attribute, and overwrite resources in another zone's namespace across the entire mesh. The issue originates from the KDS sync code in Kuma, which serves as the foundation for the Kong Mesh control plane.