# Security boundary

The static frontend is not a security boundary. Hiding links or checking a role in JavaScript is not access control. Supabase Row Level Security and/or trusted server functions must enforce tenant and role permissions. Never expose service-role keys in browser assets. Windows agent authentication and ingestion must be designed separately and reviewed before implementation.