Authorization boundary
Postgres RLS policies enforce access to maps, sources, channels, and related records. Client code may hide or disable actions for usability, but it must not be the only authorization check.
Mutable Map, Layer, connection, and binding rows are authoring state and are directly readable only by editors, owners, and bounded operational admin paths. Viewer and anonymous rendering uses security-definer read projections over immutable published Map revisions. Direct access to revision tables is not a public API because it could reveal hidden Layer configuration.
An anonymous private-Map capability is represented by a server-signed JWT that contains only the private-version-link and Map identifiers. RLS checks the live capability row on every Map and Source read; a JWT alone cannot outlive link expiry, revocation, or ownership transfer. The raw 256-bit capability is sent to the exchange endpoint only by POST and is never placed in a request path.
Administrator UI follows the application-wide debug mode (Cmd+I or Ctrl+I). With debug disabled, administrators see guest controls; enabling it restores the administrator interface and diagnostics. There is no separate guest-preview switch or exit button. Debug preference uses the actual account identity, so hiding account controls cannot reset the shortcut or its stored state. The non-admin preview remains available inside the debug interface.
Administrator previews of user and guest interfaces are presentation-only. They can suppress the effective UI role or session, but they do not change the authenticated profile, Supabase session, server authorization, or RLS context.
Accounts are provisioned by an administrator through the admin-create-user Edge Function. It validates the bearer token with Supabase Auth and checks the live is_admin() database role before using the server-only Auth Admin API. New profiles retain the default user role and quotas; role changes continue through the existing admin RPC. Request metadata cannot assign an application role.
Google OAuth is the only supported application sign-in method. Account provisioning is an internal administration action and does not authorize adding password sign-in or sign-in controls to public map pages. Hosted Auth must keep the Email/password, Phone, and anonymous providers disabled.
Required verification
Every new or changed RLS policy requires database tests covering the relevant owner, editor, viewer, anonymous, administrator, and service-role boundaries.
Secrets
External API secrets are available only to server-side workers and Edge Functions. They must not enter browser configuration, generated artifacts, logs, map recipes, or this knowledge bundle.