# Workspace Security & Governance Guidelines

**Document Version:** 1.0.0 (Phase 18)

---

## 1. Multi-Tenant Isolation & Authorization

- Every administrative route requires server-side validation against `TenantContext`.
- API keys are hashed with SHA-256 and never stored or returned in plaintext.
- Invitation tokens are cryptographically randomized (40 characters) and single-use.