Security
SakshamOS uses authenticated sessions and database Row Level Security as the authorization boundary. The browser application is designed to use only a publishable Supabase key.
Role separation
Institute Admin and Master Admin workspaces are separate. Master Admin authority is controlled by the database role rather than by a visible email check in the browser.
Data protection
Institute records are scoped to the institute identity. Deactivation preserves records instead of deleting them.
Deployment rule
Never place a Supabase service-role key in frontend files or Cloudflare Pages.