Tenant isolation
The Supabase schema uses organization-scoped tables and Row Level Security policies for restaurant data.
Access control
V1 roles include owner, manager, server, kitchen and cashier. Product behavior can layer more permission checks on top.
Operational posture
Environment secrets stay outside the repo. Public pages are static or server-rendered and app routes are protected by middleware.