SECURITY / MAKE THE BOUNDARIES EXPLICIT

Control begins with configuration.

Model the data and the access policy together. AutoTable provides project context, route authentication, authorization settings, and server-side credential handling.

Configure your first project

Explore the platform

CONTEXT

Tenant and project scopes.

Requests select a tenant and project. Keep application data and configuration in the intended scope and test cross-project access expectations.

IDENTITY

Authentication per route.

Choose which operations require an authenticated session. Public content reads and application writes can have different policies.

PERMISSIONS

Authorization per operation.

Set the allowed roles for configured routes and verify the behavior with the actual users who will call them.

VALIDATION

Rules at the data layer.

Declare field types, required values, and supported values in the container instead of relying only on browser checks.

CREDENTIALS

Secrets stay server-side.

External API credentials are stored through the backend with its configured encryption key. Keep provider tokens out of public content and frontend bundles.

REVIEW

Test the complete path.

Check public access, authenticated reads, writes, and workflow behavior using the deployment configuration you intend to ship.

A SENSIBLE STARTING POLICY

Open only what the product needs.

For a public website, anonymous reads may be appropriate for published content. Content mutation and administration should require the relevant authenticated role.

For a private application, review each enabled route, including bulk and workflow execution. A hidden button in the interface does not replace a backend access rule.