owner > admin > member. Each API operation declares a minimum role and the
control plane enforces it for dashboard sessions and API keys alike. API keys are organization
scoped and can carry member or admin; owner-only work remains tied to an interactive session.
- Store API keys and shown-once connection strings in a secret manager.
- Use runtime tokens inside deployed apps; never ship an organization API key to a browser.
- Treat exported
********values as preserve-live-value markers, not secrets. - Require a human confirmation for destructive CLI and agent actions.
- Use the server App Auth client and
HttpOnlycookies for security-sensitive applications.