Data model, security and isolation

The primary business-data boundary is the workspace. Organizations group membership and plans; each product owns its records. This explains the model in plain language, not a certification of a live deployment.

How records connect

Customers provide shared identity across leads, bookings, orders, quotes and invoices. Catalogue products/services define what is sold or booked. Files / Tags / Comments / Activity add shared supporting information. Custom fields extend record types. Agents / Chats / Runs / Approvals / Memory preserve AI work state/history. Use the module reference for current names; old report table counts are not current capacity figures.

Three gates

RLS, row-level security, is the database filter for records visible to a person in a workspace. Searching or knowing another record's ID does not expand it. Scoped transactions bind user/workspace; policies are generated from module contracts. Engine tables have separate policies/exemptions, so not every database table has identical protection.

Writes and events

Actions declare inputs, preconditions, effects and events. The runtime checks access/input/business rules in order and records changes/activity. A module cannot directly write another module's table. Cross-module reads are declared dependencies; screen contributions are separately declared. A customer's Appointments tab does not duplicate the customer model.

Archived records may disappear from normal reads; deletion goes through the proper authorized gate. Partial bulk results report actual successes/failures. Emitting an event does not mean its subscriber finished; inspect background jobs.

AI, memory and devices

Era/agents use the person's current permissions. Personal/module/workspace memory audiences narrow visibility; searches/graphs return permitted knowledge. Personal BYOK keys are not added to shared workspace keys. Unpairing a computer stops job delivery but does not automatically erase local provider sign-ins.

API keys are shown once and stored as digests; provider secrets use vault paths. Audit changes redact secret values. These mechanisms are not proof that every legacy code path has been audited identically. Owner/superuser connections bypassing RLS or incorrectly scoped service paths can affect isolation; production reviews must verify connection roles and relevant paths separately.

What to inspect

Check the active workspace, roles, approvals, privacy retention and API scope. Ask Era “Which permissions and workspace are you using for this operation?” Do not share real customer data in example screenshots.