Security principles
- Least privilege and contextual access
- Controlled evidence storage with integrity metadata
- Append only audit for material actions
- Provider adapters and signed external events where applicable
- No caching of sensitive Case or document routes in the PWA foundation