Security Model JWT auth, RBAC, workspace authorization, document ACL payloads, prompt-injection checks, PII detection, CORS, and audit-ready models.