Legal
Security
Tenant isolation, RLS, secrets off the repository, encryption of YouTube tokens.
Isolation
Every table that holds workspace data has RLS forced, backed by the tenant identifier set in the transaction. A plan or tenant identifier coming from the browser is not an authority.
Secrets
Generation keys, Stripe and YouTube stay on the server. The client does not call the YouTube API. OAuth tokens are encrypted.
Theater
No JavaScript written by a model is executed. The pipeline is a static host program. The experts have an abstention policy, not a free-form tool.
Locked content
The full body of a script is never served without a server-side entitlement. A CSS mask is not a protection.