Tenant isolation
Tenant identity is resolved server-side and every command/read boundary must remain scoped.
Tenant boundaries, explicit authority and auditable operations.
Afluma Commerce is designed around server-derived tenant context, permission boundaries, secret isolation, idempotent financial operations and retained audit evidence.
Secrets
Provider credentials belong in environment or secret storage references, not merchant-facing records.
Auditability
Privileged, financial and recovery actions should preserve actor, reason and request evidence.
Safe failure
External outages render explicit pending, retry, unavailable or dead-letter states—not fabricated success.