Secure browser sessions
Opaque sessions use Secure, HttpOnly, SameSite=Strict cookies with CSRF and exact-origin checks.
Security built around boundaries
Credentials stay backend-only, authenticated browser data is not cached for offline use, and unsafe provider state blocks production actions.
Tenant and role enforcement
Every authenticated action resolves the active user, tenant, role, subscription, and revocation state on the server.
Provider controls
Credentials, signed webhooks, allowlists, readiness, and global live switches remain explicit and auditable.
Minimal public evidence
Public responses never identify internal tenants, mailboxes, provider accounts, secrets, or raw payloads.