# Authentication, data, and permissions

> Separate Rogue account access, generated-app sessions, authorization policies, service credentials, and data portability.

[Canonical page](https://rogueon.ai/docs/data-and-permissions)

## Separate the trust boundaries

Your Rogue session grants access to the builder. A user session inside a generated app belongs to that app's authentication flow. Database access and external-service authorization are additional boundaries. Success at one layer does not imply access at the others.

Treat frontend files, rendered content, and downloaded assets as observable by the client. A preview URL or noindex instruction is not an authorization mechanism. Use synthetic fixtures in specifications; keep secrets out of prompts, client bundles, URLs, screenshots, and exported source.

## Authentication is not authorization

A login form establishes identity only when it is wired to the app's authentication service. Authorization must still constrain which records and actions that identity can access. Test anonymous access, two different users, and any administrative role; hiding a control in the UI does not enforce a server-side permission.

For managed database-backed projects, authentication can depend on same-origin routing and host-specific session cookies. Moving frontend files to a new host changes that environment. Review origins, cookie behavior, session acquisition, and data-access configuration instead of copying a production URL into a local project.

## Validate storage and credential ownership

| Boundary | Required check |
| --- | --- |
| Persistence | Distinguish in-memory state, browser-local storage, and shared backend records. |
| Isolation | Verify reads and writes with two users; enforce policy in the data service rather than only a visual filter. |
| Credentials | Use the supported key control; identify account ownership, billing, revocation, and rotation responsibility. |
| Database lifecycle | Read displayed status, expiry, and transfer information; provisional storage is not permanent storage. |

## Code portability and data portability differ

A repository export contains frontend artifacts, not a complete migration of application records, identities, service keys, or server-side infrastructure. Before cutover, inventory dependencies, determine how data and accounts will move, verify access at the destination, and keep a recovery plan for the source environment.

Use the Privacy Policy for Rogue's data-handling terms and the team contact for account-data requests. This technical guide does not establish a retention guarantee for every generated app or provider.

- [Privacy Policy](https://rogueon.ai/privacy)
- [Contact](https://rogueon.ai/contact)

## Related guides

- [Project and runtime architecture](https://rogueon.ai/docs/project-architecture)
- [Integration boundaries](https://rogueon.ai/docs/integrations)
- [Export and external development](https://rogueon.ai/docs/exporting)