What is enforced, and what is not claimed.

Identity is decided once, ahead of everything else, and the same check covers an ordinary page request and the live engine connection alike — the engine connection is authenticated exactly as a page load is, with no second, weaker path beside it. A signed-in customer session is the front door; the operator's admin surface sits behind a separate identity, verified independently of any customer session and scoped to that surface only. Public paths are matched exactly or as a real subpath, never as a shared string prefix, so no URL can be crafted to look public by prefix.

Passwords go through a deliberately slow, memory-hard hash — the kind chosen to make offline guessing expensive — not a fast general-purpose digest. Sessions are database rows rather than self-contained signed cookies, so suspending an account ends its live sessions on the next request. Email verification and password-reset links are single-use, stored only as a digest, and minted against a closed set of purposes: a verification link cannot be redeemed as a password reset.

Authentication and authorization are separate answers. An account is pending, active, denied, or suspended; only an active account has any rights at all. New accounts are always created pending with the plain user role, and the administrator role can only be granted through the admin API — never self-assigned, never inferred from a token the client supplies.

Each account gets its own workspace and bucket tree, and every file API resolves paths under the caller's own root. On the engine bridge, the client's claimed identity is overwritten with the verified one, and any remote call naming an absolute path outside the caller's roots is rejected outright. Provider-management calls are administrator-only, and credentials arriving from a browser are stripped before the call is forwarded.

Rate limits key on the authenticated account, never on a client-supplied value, so one account cannot spend another's budget. Sign-in attempts are throttled per address and per network before any password hashing happens, because a memory-hard hash is a denial-of-service amplifier if an attacker can spend it for free. Uploads carry a size cap, per-account storage is quota-checked, engine frames are capped, and a single account cannot fan out unlimited concurrent engine connections.