No valid context, no tenant rows.
- Missing or invalid signed context yields no tenant-scoped rows.
- Runtime SQL clients cannot manufacture trusted tenant bindings by setting PostgreSQL GUC values directly.
- Tenant-scoped data uses forced row-level security.
- Role history is immutable and grant cycles are rejected.
Separate privileges by job.
Migrations, runtime requests, and maintenance operations use distinct database roles. The maintenance adapter has a separate pool and can export or purge tenant policy data without reading identity or session tables.
Credentials remain server-side.
Administrator passwords use Argon2id. Refresh credentials rotate, remain in HttpOnly SameSite=Strict cookies, and are never returned in JSON. Runtime database credentials and tenant-binding secrets remain high-value operator secrets.
The Console is an administrative interface.
Protect it with HTTPS, restricted administrator accounts, monitoring, backups, and a deliberate exposure policy. The public Demo is a technical preview, not a production SLA or managed service.
Report vulnerabilities privately.
Do not open public issues for suspected vulnerabilities. Follow the repository security policy and include the affected component, reproduction details, and impact.