Server-side isolation and permission

Each person sees only the work that belongs to them.

F6 evaluates identity, Workspace, role, Project, protected resource, and capability on the server for every operation.

An identifier from another Workspace does not reveal whether a resource exists and never expands access.

What changes

Queries, writes, children, and background jobs preserve the Workspace boundary.

Financials, documents, identity, and secrets are omitted without exact permission.

Sensitive actions include actor, target, time, and correlation.