What we build toward
- Per-tenant data isolation (RLS + app guards)
- JWT-ready identity and role enforcement (Integration Sprint)
- Audit logs on critical actions
- HITL before OT writes; agents recommend-only by default
- Azure-first secrets and regional residency paths
