Only Root Admin will have the privilege to dedicate pod, cluster or host to specific domain or an account.
If a user does not belong to a domain which has dedicated resources, he cannot access the pod, cluster or host dedicated to that domain/account.
Users belonging to domain/account having dedicated resources, can access them but should not be allowed to modify.
At this time, there is no requirement for the domain/sub-domain admins to manage the resource - the root admin will remain the owner of the resources
Only Root Admin can add a service offering with "isdedicated" option enabled.

Use Cases:

Domain level accessibility of Pod/Cluster/Host

...

Root Admin must be able to dedicate a pod, cluster or host to any domain or sub-domain.
Once a Zone is dedicated to a domain, its pods and clusters will be dedicated to that domain eg: pod: p1 is dedicated to domain D1, clusters:c1, c11, c111 will be automatically dedicated to D1 by default.
Users in Sub-Domains SD1, SD2, SD3 should be able to deploy vm in parent domain's clusters c1, c11, c111 or pod p1.
After dedicating pod p1 to domain D1, if further cluster c11 (in pod p1) is dedicated to SD3, then D1 or SD1 or SD2 should not be able to access c11. (Can SD3 use SD2, SD1 or D1's resources, verify)
If another pod p2 is dedicated to SD1, then SD11, SD12 or D2 should not be able to access pod p2.
Before dedicating a pod to a domain , check whether its zone is dedicated or not.
Child Domain can access pod/cluster/host dedicated to parent domain, vice-versa is not (verify).
If there is no available resources among the hosts dedicated to the sub-domain SD1 then operation should fail.## However, root admin can modify a global parameter indicating if child domain can use from parent pool or not. (By Default the value should be false)

If there are no available resources among the hosts dedicated to the domain or subdomain then CloudStack should fail the operation.

Architecture and Design description

...