startup/shutdown of Oracle inside non-global zone, Solaris 10, VCS 5.1

You can prevent the guest seeing the global zone if the guest is unable to resolve the host name of the global zone - for most agents this won't cause the agent to fail - the engine log will just complain that the local zone cannot log back to the global zone.  Note, if you remove .vcspwd file then this will get recreated next time the Zone resource onlines.  Note also the user created so that the local zone can communicate to the global zone is an administrator of ONLY the service groups containing the zone resource, so you can not shutdown the cluster or change any other SGs, but you could bring down the Service group containing the zone, but if you are root in the local zone then you could do this without VCS.

You could prevent root login to the local zone, then this prevents the local zone seeing global zone, unless you zlogin in from global zone (which means you had access to VCS from the global zone)

Mike