JIT inside a CNAPP+, not beside one
When Cloudanix mints a credential, it knows the resource's posture state, the identity's CIEM permission graph, the attack-path it sits on, and whether the runtime workload has active findings. Teleport's access decision is RBAC + role conditions — it doesn't know whether the target instance has a public-IP plus a high-blast-radius identity attached.