Architecture and security review

Diagram

Findings

ID	Severity	Location	Issue	Recommendation	Residual risk
R1

What we will not automate

Production-shaped variant (not implemented)