ADR-0011: Surfaces: BOS Console vs Client App

• Status: Accepted
• Date: 2026-07-25
• Deciders: El

Context

Authoring (which writes the control plane) and client-facing review (which reads a tenant's own data) have different auth and isolation domains.

Decision

The BOS Console is central, operator-only, edits the control plane, and is reached through the Internal Portal UI but remains a separate service (an imported front-end module with its own back-end write path). The client review app is per-tenant, reads only that tenant's own data, and has no control-plane write access; a read-only copy of the resolved config is pushed into each tenant stack so the client surface never reaches up to the shared plane. The Console is the editor of the control plane; the brain is the reader. Clients cannot edit their own rules for now — the operator authors on their behalf.

Consequences

Isolation domains kept separate; the client surface is fully contained (holds a credential to nothing but itself); the Internal Portal must surface the Console but must not become the codebase that owns control-plane writes (coupling risk to guard).

Alternatives considered

• A single "portal" doing both — rejected: auth and isolation domains differ.
• Per-tenant authoring consoles — rejected: the operator must manage all clients centrally, and it scatters control-plane write credentials.