Architecture
Applications
| App | Purpose | Host |
|---|---|---|
user-gui | The product | demo.sanctumboard.com |
admin | Platform console, reads across tenants | admin.sanctumboard.com |
assess | AI governance assessment | assess.sanctumboard.com |
docs | This site | docs.sanctumboard.com |
Separate deployments on purpose. The admin console holds a credential that can read every board; it must not share an environment with the app serving one.
Tenancy
One database, row-level security with FORCE on every tenant table, and an
application role with BYPASSRLS = false. The board is bound per request via
AsyncLocalStorage — requireSession calls runWithBoard, so nothing
downstream needs to be handed a board id and nothing can forget to pass one.
board_registry.database_ref exists for per-board databases and is not yet
used to open a connection. Enterprise is refused at provisioning rather than
being silently pooled.
The AI path
Prompt assembled by the app → Bedrock Converse in ap-southeast-2 via an
au. inference profile → SSE reframed into the contract the Pam panel speaks.
Streaming is preferred; a model that rejects ConverseStream falls back to
non-streaming on the same model. Never to another provider.
Credits
Reserve → call → settle, with a hard stop at zero. The ledger is append-only and foots: settlement posts both a release and a consumption.