Musou: reliability and security grew with the relationships

As Musou added private coaching, payments, workshops, media, and messaging, a simple role label could no longer describe the access people needed. The team had to ask more specific questions: coach of which client, host of which workshop, buyer of which replay?

Database permissions were tightened around those relationships. Coaches were limited to assigned clients. Workshop hosts could see purchase information for their own customers rather than everyone. Private workshop media and coaching records were protected from unrelated users, and subscriber content was enforced below the interface. Roles were separated from profiles, movement videos used temporary viewing links, and payment status was reconciled through signed server callbacks.

Recording reliability needed similar care. Capture logs made the start, duration, upload, backup, and failure states observable. Local backup was removed only after a confirmed upload. If a recording didn't exist, the team had to say so and improve the safeguards. Implying that a missing asset could be recovered would only make the next conversation harder.

The controls became useful as they followed the actual relationships and consequences of the work.

---