What is enforced, and what is not claimed.

Ordinary requests and live engine connections use the same authenticated server-side session. The operator's administrative surface uses a separate verified identity. Public routes are matched as exact paths or valid subpaths, not by a shared string prefix.

Passwords use Argon2id. Sessions are server-side database rows so they can be revoked and account suspension takes effect on the next request. Email-verification and password-reset tokens are single-use, stored only as SHA-256 digests, and bound to their intended purpose.

Authentication establishes identity; account state and role determine authorization. Only active accounts receive product rights. Customer roles cannot be self-assigned or taken from a token supplied by the client, and administrative operations require the independently verified admin identity.

Each account has its own workspace and bucket roots. File APIs resolve paths beneath the caller's root, and the engine bridge rejects absolute paths outside those roots. Personal provider credentials are account-scoped; engine calls from the browser cannot supply a credential inline and receive only the validated connection selected for that account. Shared provider configuration remains administrative.

Rate limits key on the authenticated account and network rather than a client-supplied identity. Sign-in is throttled before password hashing. Uploads, storage, engine frames, and concurrent engine connections have enforced caps.