softDesign requirements
These principles guide the product build. They describe the intended security model, not a certification or a claim that the backend is complete.
Workspace boundaries
Membership, brand data, jobs and tools must be scoped to a workspace. Isolation and permission tests are required before customer access.
Permission before connection
Provider access requires authorized accounts, appropriate scopes and revocable credentials. A connection cannot grant unsupported capabilities.
Approval for consequential work
Publishing, imports and budget changes must pass server-side policy and, where required, approval tied to the exact proposed action. AI receives no unrestricted SQL or shell access.
Evidence and reporting
Task history should show what was proposed, who approved it and what happened. Report concerns to support@softdro.com without including secrets or private records.