13. Security and trust boundaries

Authority belongs at the source boundary

Client presentation is not enforcement. A hidden action button cannot protect a command. A dashboard record cannot authorize access to the underlying subject. Authentication identifies an actor; current authorization decides what they may do.

Audience resolution, resource visibility and action authority are separate responsibilities. A group or role can describe useful operational context without granting permission.

Public and private projections

Public pages must expose deliberately selected information. Private records should not accidentally travel through serialized props, metadata, public media or human-facing error messages. A public projection is its own disclosure boundary, not a prettier rendering of an unrestricted application record.

Files require similar reasoning. A reference to a file should not be treated as an access grant. Resource review refers to exact content, while access to that content remains subject to current policy.

Delayed work retains a boundary

Queued processing occurs after the original request. Source state and recipient eligibility may change. The conceptual obligation is to preserve the source’s current boundary when projecting or delivering work, rather than treating earlier queue admission as permanent authority.

This paper does not disclose exact security settings, internal bypasses, recovery procedures, production identifiers or unresolved vulnerabilities. These details would not improve the core architectural explanation.

Evidence and limits

Scoped local verification can establish specific properties of contracts, transitions and access boundaries. It does not prove every browser or provider behavior, and it does not establish complete production acceptance. The evidence page keeps those claims separate.

This static site also has a narrow responsibility: publish safe explanations without production credentials or data connections. Pattern scanning adds useful checks, but no pattern scanner can establish that every paragraph is safe, accurate or appropriately attributed. Editorial review remains part of public release.