Or
// A machine agent can access all containers that declare it to be their parent

I do wonder about nested containers, but we can deal with that when we know more.