Environments

Environment is part of the authorization decision, not a display filter. Orders, customers, results, programs, integrations and credentials are always read within one workspace and one environment, and a Sandbox key never reaches Production data.

Activation creates the canonical live Production workspace while preserving a paired companion Sandbox. The pairing is explicit and one-way: the Sandbox points to its Production workspace, and Production never depends on Sandbox state to operate.

The pair is persistent but isolated. Safe laboratory configuration can support continuity, while Production credentials, endpoints, adapter state, entitlements, Programs, orders, customers, results, webhook subscriptions and operational history are never shared across the boundary.

Production operational surfaces use only Production evidence. Sandbox fixtures, test orders, Programs, deliveries and logs never contribute to Production metrics, attention items, connection health or authorization decisions.

• Authorized Sandbox members can open Overview, Orders, Customers and Results immediately. Before any data exists these surfaces show normal empty states rather than setup gates.
• Integrations and Production readiness can be explored before their step is current; operational actions remain prerequisite-aware and the canonical current-step guidance stays authoritative.
• Viewing a future surface never satisfies a prerequisite or advances setup.

After go-live, authorized members can switch between Production · LIVE and Sandbox · TEST. The Sandbox shows the six completed setup steps and remains the safe place for synthetic rehearsals without reopening onboarding or mutating Production.

Keys, Program grants, installation identity and evidence belong to the exact environment. A Sandbox synthetic loopback pass cannot become Production proof; failed or missing current authority reads remain blocked/unknown.