Security measures
Owner-review template for technical and organizational measures.
Owner review required. Draft template. Production publication remains disabled until the owner supplies approved legal text and operational ownership.
Boundary controls
Authenticated requests use tenant-scoped server context, allowlisted mutations, CSRF protection, least-privilege connector scopes, encrypted object storage, and immutable audit records.
Operational ownership
Named security, release, provider, billing, and on-call owners plus incident response contacts must be supplied before production promotion.