Security model

1. Authentication is not authorization: every route proves the session or key may act on the exact target.
2. Request values (tenant, application id, user id) are selectors only; scope is derived server-side.
3. Cross-tenant access is 403. Where existence must be hidden, a consistent 404.
4. No backend secret, provider secret or secret-file path is ever sent to the browser or held by the edge.
5. Missing credentials and unreachable engines fail closed.

The public security page describes deployment: encrypted mounts, secrets materialised at deploy time, internal TLS and pinned engine certificates.