SECURE SESSION · HttpOnly BFF cookie · server authorization enforced
Sovereign control plane