# Auth And Data Ownership

The web Front is a backend-for-frontend, not a system of record.

## Ownership Boundaries

- Keycloak owns identities, roles, login, logout, and token issuance.
- Backend owns customers, users, customer API keys, documents, activity logs, tenant resolution, and authorization decisions.
- Front owns Blade/UI routes, OIDC session hydration, and calls to backend APIs using the current user's bearer token.

## Front Constraints

- No Eloquent user/customer/document/activity models.
- No migrations, seeders, local database sessions, local database cache, local database queues, or password reset tables.
- No local login credentials or `Auth::attempt` flow.
- No tenant or customer headers derived by Front; backend resolves tenant context from authenticated claims and membership.

## Runtime Defaults

- Local Front defaults to cookie sessions, file cache, and sync queues.
- Aspire overrides Front to Redis sessions/cache and sync queues for distributed local validation.
- Backend APIs enforce admin/user policies and tenant scoping for document/admin flows.