Purpose-bound authorization reference: RBAC + ABAC + ReBAC, row/field controls, fidelity gates, lifecycle governance, and a tested 100K synthetic-data path.
Sandbox npm dependency install scripts with least-privilege filesystem, environment, network, and process access.