Intents carry identifiers only. Templates are allowlisted and escaped. Sensitive workflows use generic “open CASA securely” wording. Secrets rotate with overlap; webhooks require signatures. No contact lists in the browser.

Side effects run via transactional outbox, Cloud Tasks and Pub/Sub. UI shows queued/processing/retry from owner-scoped job documents — never poll faster than 5s or list unbounded. FCM/notifications are informational and cannot change business state. Missing queues stay ENVIRONMENT_BLOCKED.