Trust boundaries
PreviewMeaning: Visible for evaluation; public access is not open.Security
Understand which parts of a GraphMem experience belong to the browser and which must stay server-enforced.
Authority stays server-side
The browser can present consent, loading, and error states, but it cannot decide who may read or change memory. Identity, organization and project membership, scope, visibility, limits, and storage policy must be enforced by the owning services.
- A client-visible project selector is not proof of membership.
- A hidden node or filtered edge is not a security boundary.
- A successful readiness probe is not proof of customer-data authorization.
- Errors should expose safe, actionable states without leaking upstream details.
Current public surface
Public documentation pages make no GraphMem data request. The customer console is a separate browser boundary: its server-side BFF consumes an origin-bound OAuth handoff, resolves token-derived scope for every read, and returns bounded projections. Browser-selected organization or project identifiers are never treated as authority.