The token carries all context
Id, identity type, exactly one tenant, and scopes — effective rights intersect them with the client row. An incomplete token is fully refused.
Second factor for publishing
Publish and admin operations require multi-factor amr; without it, 403 with MFA_REQUIRED.
One tenant per request
No default tenant and no crossing: an id outside your tenant is 404, and one tenant's membership grants nothing in another.
Isolation in the database
Row-level policies above application filtering — and the application role cannot bypass them.
Append-only audit
Publishes, grants, and review bypasses are recorded in a hash-chained (SHA-256) log; there is no delete path for any role.
Your secrets are your duty
Server-side environment variables, separated per environment, rotated on suspicion. No keys in repositories or logs.
Never send student data
Curriculum content submitted for review or import that carries learner personal data is refused whole and recorded for the Security Owner — never partially accepted. Send no such data by any other route either.
AI does not publish
Its outputs are candidates under mandatory human review; it has no admin tools and no direct writes.
More
The public security page covers institutional controls; the errors page covers failure codes.