Safe by construction

• Retries never duplicate.
  • Every write accepts an idempotency key, and a repeated create replays the first answer.
  • Every entity carries a version, and a write against an outdated version is refused rather than overwriting someone's change.
• Same permissions as the person. An agent cannot see a project its person cannot see. A project it has no access to does not appear to exist.
• Everything is attributed.
  • Each change is recorded under the person whose key made it.
  • Quasar separately notes that an agent produced it, and the web app shows an Agent badge.
  • Nobody has to declare this: it comes from the key.
• Rate limits. Each key has generous limits, so a runaway loop slows down instead of degrading the service.