The shared platform uses layered access: the edge verifies a staff identity, then each product enforces its own least-privilege role before executing an action.
Authorization boundary
- House Desk and Pub keep separate roles and audit histories.
- A shared identity or group does not grant a product action by itself.
- User interfaces may hide unavailable controls, but the server independently checks each request.
- Machine integrations use narrower contracts than human administrator sessions.
- Unknown or unavailable authorization state should not create additional access.
Public documentation boundary
This site may publish:
- resident and operator tasks;
- observable behavior and user-visible recovery paths;
- deliberately public routes and interoperability contracts;
- high-level architecture, ownership, privacy, and authorization concepts;
- sanitized examples and screenshots.
It does not publish credentials, private addresses or identifiers, real records, exact recovery procedures, protected control surfaces, exploit-enabling fallback details, or proprietary design and operating playbooks.
Data separation
House Desk resident data, Pub operational data, and Authentik identities are separate stores with separate purposes. Restoring or changing one does not create roles or records in another.
Documentation-site privacy
This site accepts no product account or resident submission. See Documentation-site privacy for the narrower data practices of the docs site; product collection belongs with the product surface that requests it.