Musou: reliability and security grew with the relationships

As Musou added private coaching, payments, workshops, media, and messaging, a simple role label was no longer a sufficient control. The relevant questions became relational: coach of which client, host of which workshop, buyer of which replay?

Database permissions were tightened around those relationships. Coaches were limited to assigned clients. Workshop hosts could see purchase information for their own customers rather than everyone. Private workshop media and coaching records were protected from unrelated users. Subscriber content was enforced below the interface. Roles were separated from profiles, movement videos used temporary viewing links, and payment status was reconciled through signed server callbacks.

Reliability required the same specificity. Capture logs made recording start, duration, upload, backup, and failure states observable. Local backup was removed only after confirmed upload. When a recording did not exist, the correct response was to say so and improve the safeguards—not imply that a missing asset could be recovered.

Governance became useful because it followed the real consequences of the workflow.

---