Every client is a sealed workspace.

A workspace is a brand or a client: its own accounts, media, brand kit, voices, calendar and members. Every query goes through workspace-scoped helpers, and a read that reaches across the boundary returns 404 rather than 403 — a probe cannot even confirm the row is there.

“Covered by tests” is a phrase every vendor uses, so here is the specific version, with the file name. Twenty-nine tests in packages/core/src/services/__tests__/tenancy-isolation.db.test.ts run against a real Postgres database rather than mocks, and try to reach another workspace’s posts, approvals, media, inbox, analytics, API keys, OAuth grants, schedule slots and brand voices. Sixty-two of those attempts — one per service call — go through a single shared assertion that fails unless the answer is a 404: not a success, and not a 403, because a 403 confirms the row is there.

Roles map to how teams actually work. An Editor writes and edits but cannot publish. A Publisher ships but touches neither billing nor members. A Client approves and comments, and can do it from a link without creating an account — the link is signed with an HMAC, so it cannot be forged or edited into wider access than it was issued for.

The review loop itself is where most tools hand you back a screenshot. Approvals run in one step or two. Comments thread one level deep, so a reply to “change the second line” sits under it rather than restarting the conversation at the bottom. Every save writes a version, and version history word-diffs any past version against the current body and restores it as a new version rather than rewriting history — and it refuses to restore a post that is mid-flight to the networks, because swapping the body under the publisher is how a client gets the wrong post. Posts carry an assignee, so “who has this” is a field rather than a thread in Slack.

Every destructive or administrative action is written to an audit log with who, what and when.