Security

Every rule is kept by the server, never by the client. Roles, workspaces and the append-only timeline are described here in phase 6.