Security and operations

Security and operations — contract and behavior

• Authenticated route groups are backed by server authorization on every organization-scoped read and write.
• Database service credentials, model credentials, provider tokens, and social sessions stay server-side.
• Generated media, character datasets, campaign plans, analytics, and publication state are organization data.
• Diagnosis starts with the durable lifecycle record and separates provider failure, queue failure, human rejection, storage failure, and channel delivery failure.