Security
The browser presents. The backend decides.
Flagship Tracker issues session cookies from NestJS. Role checks run on the server. The Next.js app is presentation — lists, boards, and this marketing site included.
Boundary
Next.js → NestJS → PostgreSQL. Never Next.js → database.
If a capability is sensitive — login, RBAC, Git tokens, audit — it lives in Nest. The frontend consumes GET /auth/session and typed APIs. That is the shipped architecture.
Controls
Sessions, roles, and a presentation-only client.
These are product facts, not a promised whitepaper. The legal stub remains for the policy text that is still awaiting publication.
Session cookies from Nest
Login and logout are backend routes. The product UI reads the session; it does not mint it.
RBAC on every mutation
Board, roadmap, reports, knowledge, workflow, and people are capability checks per project.
No Next ↔ database path
There is no Drizzle client in the product frontend or this marketing site. Postgres is reached only from Nest.
Isolation
Tenancy is org, department, and project.
People are added to a project with a role. They do not inherit a global admin switch that opens every department.
Grants
The permission matrix is a settings surface.
Admins see which built-in role can open reports or manage people. Limited members can work a list without receiving workflow or invite rights.
Evidence
Audit events are written with the change.
Omar changing ATL-191 to Critical is an audit row, not only a comment. History is stored by the backend.
Ask for the architecture in a live tenant.
Contact sales to walk sessions and roles, or sign in if your administrator already created a workspace.