Panopticon is designed for a trusted-network deployment.

• There is no user authentication or authorization layer.
• Anyone with UI/API access can mutate session evidence.
• Observational providers are read-only; active HTTP actions are not part of this release candidate.
• A single Panopticon process owns operational-session writes.
• Manual assisted-analysis packages leave the Panopticon trust boundary only when an operator explicitly downloads them.

• Hidden provider credentials are excluded from reports and assistant packages.
• User-authored session text may still contain secrets or sensitive details.
• Panopticon does not automatically redact all sensitive content typed into notes, Markdown, annotations, or recorded evidence.
• Evidence sent to an external AI provider must be reviewed explicitly by the operator.

• The assistant package is derived only from persisted report evidence.
• The package contains deterministic instructions and a bounded evidence index.
• Session content is treated as untrusted evidence, not as instructions.
• External AI invocation is deferred in this iteration.

• Session evidence is confined to the configured session directory.
• Markdown content is loaded from the configured content directory.
• Dashboard and data configuration are loaded from configured config roots.
• Absolute filesystem paths are not exposed to browser clients.

• Use a trusted internal network or a protected reverse proxy.
• Terminate TLS before Panopticon if required by deployment policy.
• Rotate and back up the session directory, dashboard definitions, content files, and related config directories together.
• Verify replay and reports after restore rather than assuming atomic backup across unrelated directories.