The architecture is prepared for a strict separation of domain, application, infrastructure and HTTP concerns.
Tenant isolation is enforced by the backend and API.
The SuperUser role only manages data within its own account.
The frontend does not duplicate business logic and relies on backend contracts.