A control plane only works if trust boundaries stay explicit.
This frontend is designed around the security model already defined in the Handybot architecture docs: separate control-plane data, separate business databases, and versioned API boundaries.
Authentication Boundary
Identity belongs to the portal layer. OAuth providers and session lifecycle are exposed to the browser via `www.handybot.help`, while mutations terminate on `api.handybot.help/v1/auth/*`.
Secret Handling
The portal should store secret references or masked values. Raw API keys and provider secrets must stay server-side and be resolved during publish or runtime.
Billing Trust Model
Stripe remains the system of record for subscriptions, invoices, and payment methods. Portal DB keeps only customer IDs, subscription state, and credit ledger mappings.
Tenant Isolation
Portal metadata is centralized, while each tenant business database remains isolated. Runtime resolves tenant identity before connecting to the correct tenant DB.