PUBLIC BOUNDARY POLICY SHELL · DRAFT

Security overview

The public customer plane is isolated from the private Program Control plane.

Current P1 behavior

No Program Control, manager, runner, backup, protected-project, job, billing, or provider binding is present.
The MCP resource fails closed before body parsing or storage until approved OAuth is available.
Separate D1 and R2 bindings contain only immutable boundary state and zero customer records or objects.