Architecture

• Application layer: a React/TanStack Start application serving the Control Plane and this documentation site.
• Server layer: typed server functions for app-internal logic and HTTP routes for external callers, including the Partner API surface and its machine-readable description.
• Data layer: a Postgres database with row-level security; every operational read and write is evaluated against the caller's authorized workspace.

Authorization is workspace-scoped and fail-closed: when a caller's authorization for a workspace cannot be proven, access is denied rather than assumed. Partner API keys are additionally bound to one environment and one scope set.

Availability of any given capability depends on the laboratory's configuration and activation state. The documentation describes what the platform enforces, not what a specific workspace has enabled.