Display and fleet security
==========================

.. note:: Planned architecture.

Key rules
---------

* A Display UUID and GPS position are not credentials.
* Pairing tokens are short-lived, single-use and stored hashed.
* Display/media credentials rotate and can be revoked immediately.
* Generated View code runs in a sandbox with a restrictive CSP.
* Display writes require Assignment, Scope, Property and operation permission.
* GPS history and media access are scoped, retained and audited.
* Full frames/video never enter global WebSocket or telemetry channels.
* Mass campaigns support preview, impact count, approval and rollback.
* Signed media URLs have short TTL and audience/purpose constraints.
* Event IDs, revisions and idempotency keys protect against replay.

Tailscale provides a private transport between Agency, edge devices and local
inference nodes. Its ACLs complement rather than replace Agency authentication,
workspace authorization and application-level audit.

Generated content and AI observations remain untrusted input. Deterministic
policy decides what can be published or acted on; Veronica's probabilistic
decision never bypasses those controls.