The operational mirror is private and credentialed. Only the provisioned operator can pass this gate.