A boundary before every query.

No request reaches context without resolving its actor, workspace access, and capability scope first.

Two auth systems, one identity

Browser sessions use secure HTTP-only cookies. MCP clients never receive that cookie; they use OAuth bearer tokens tied to one revocable database grant.

What is enforced

• Workspace membership or explicit grant on every context operation.
• Short-lived access tokens with issuer, audience, subject, and resource validation.
• S256 PKCE, rotating refresh tokens, and refresh reuse detection.
• Origin validation on the HTTP MCP endpoint.
• Immutable document and schema revisions with attributable audit events.
• Schema complexity, payload size, and batch mutation limits.

Deletion and recovery

Context and table row deletion is soft by default so activity remains inspectable and recovery can be implemented without changing the data model. Account deletion is explicit and destructive.