Security

Holding data is allowed. Owning the authority is not. Live clearances require an owner-signed Mint Warrant. This is architecture posture, not a legal safe harbour.

Parent private material never enters operator infrastructure for live clearances. You hold the public half only.
No access is created from a service credential alone. Every grant needs a fresh, owner-signed warrant.
NTKA never receives Stripe keys or billing logic. Crypto authority stays in the Go trust boundary.
Withdraw consent, and data rotates to fresh keys. Old ciphertext cannot be reopened. Restore paths fail closed against dead grants.
PostgREST deny-by-default for product tables (access control, not SOC 2). Live Element Mint Warrant ceremony (ADR 0003); sandbox simulate-owner is test-only.

Deep dive in docs: Security, Threat model.

Get API Keys and prove a bounded result in sandbox.