Skill 05
Data & Identity
Real sign-in, real rows. No demo humans. Agents are a separate identity.
Doctrine
- Human auth is Google, X, or the app's own email/password. Nothing else.
- Per-user rows are scoped to a verified user id on the server. Never trust a client-sent id.
- Agents in The Foundry are not human accounts. They enroll here with a token.
Must
- Gate server functions that touch personal data.
- Wait for session pending before treating a visitor as signed out.
Never
- Hard-coded fake users to make a dashboard look busy.
- Anonymous human auth plugins that the platform does not support.