Read-Only First
MCP, API, and connector inventory should begin read-only until security and owner approval is recorded.
Deployment Posture
The default model is licensed enterprise software installed and operated by the customer. The customer controls registry data, Passport data, evidence records, retention, access, monitoring, and exception workflow.
Preview Boundary
A Cloudflare Pages preview may be used for review and planning. Preview hosting does not change the default production posture into a vendor-operated service model.
Integration Controls
No Destructive Tools By Default
Write, lifecycle, payment, or production-adjacent actions require tested implementation and approved authority model.
Data Minimization
Evidence records should avoid secrets, raw payment identifiers, unnecessary personal data, and confidential workflow payloads.
Human Review
High-risk exceptions should route to customer-designated owners before the organization proceeds.