Security and tenancy

The tenancy invariant: nothing crosses a workspace boundary, and non-membership looks like non-existence (404, never 403 leaks).

• Negative-auth registry: every tenant-owned endpoint registers probes that run a two-workspace attack suite (foreign reads, writes, reference smuggling). Forgetting to register fails the build.
• Reference integrity: cross-tenant ids in bodies (stateId, parentId, assigneeId, commentId…) are rejected as invalid_reference inside the same transaction that would have written.
• Headers: nosniff/DENY/referrer-policy on web and API; CORP same-site; attachment downloads always Content-Disposition + true stored content type; SVG never rendered inline.
• Rate limits per IP and per account on auth, uploads, comments.
• Presentation state is never authorization: pane context params, density, filters — all validated client conveniences; the server re-checks everything.

Details and the permission matrix: SECURITY_MODEL.