Tenant isolation
Authenticated deterministic code establishes tenant scope and permissions. Model output cannot change authorisation or cross a tenant predicate.
SmoozenExplore
Smoozen security and trust
Security boundaries are part of the product.
Smoozen uses deterministic tenant and role controls, bounded data contracts, redacted observability, signed callbacks, and explicit rollback paths.
Trust architecture
A calmer interface starts with clearer boundaries.
Each control answers a practical question: who may act, what may cross the boundary, and where the authoritative decision belongs.
Canonical ownership
The client remains authoritative for identity, consent, bookings, payments, safety, and final user-facing records.
Fail-safe operation
Stale data, connector failures, invalid callbacks, telemetry failures, and unavailable providers fail closed or route to manual fallback.
Least data
Capabilities receive only approved fields. Secrets, payment details, identity documents, and unrestricted records are excluded by default.
Auditable change
Sensitive actions use bounded sessions, correlation identifiers, append-only audit expectations, and explicit rollback boundaries.
Emergency separation
The owner-only break-glass path is visibly separate, time-bound, email-code protected, and still cannot bypass RLS, consent, safety, audit, or client authority.
Evidence maturity
Control design is not launch authorization.
A bounded control is represented in the current Preview interface and contracts.
Manual, security, privacy, accessibility, failure, and rollback evidence still needs its approved verification window.
Owner approval and the public launch gate remain separate from a successful build or automated test run.
Evidence required
View current status A technical pass is not a launch authorization.
Security review, penetration testing, privacy and legal approvals, manual verification, monitoring evidence, and rollback readiness remain required before production operational enablement.