# Security boundaries

The programmer API imports only the identity Prisma client and has no CUSTOMER_DATABASE_URL dependency. The member API imports only the customer Prisma client and validates short-lived signed access tokens. Keep deployment environment variables isolated per service; do not give programmer service credentials for the customer database.

The auth service is a trusted identity boundary and can issue role-bearing tokens. In production, restrict its network exposure and use internal service authentication for administrative provisioning. A single shared `.env` is for local development only; production must use per-service environment variables.

Customer national IDs and Egypt Digital credentials are sensitive. This foundation stores form payload JSON for flexibility and therefore MUST NOT be used with real data until field-level encryption and strict payload allowlists are implemented. Do not log request bodies.