Audience is not Authorization

Problem and decision

Selecting a recipient can otherwise accidentally disclose a private subject.

Resolve an intended audience and check current subject access independently.

Alternatives considered

• Let audience membership grant visibility
• Send to everyone with a matching label

Tradeoffs and consequences

Recipient eligibility and access require separate reasoning.

A targeted update or review respects the subject’s boundary.

Related architecture

• Audience
• Permission / Capability

Related workflows

• Send a targeted Production update
• Approve a storyboard

Current architectural direction; this record does not establish production release.