{
  "title": "API Key / Access Boundary v3.3",
  "public_gpt_rule": "Do not embed shared master keys into public GPT instructions or knowledge files.",
  "prototype": "API key can be used for private server-to-server prototype only.",
  "public_multi_user": "Use OAuth or per-user/session tokens before public multi-user access.",
  "workspace_isolation": "Every action call must include or derive a workspace/session boundary.",
  "contribution_policy": "Public users can create workspace overlays and contribution proposals, not canonical source mutations."
}