// 003
Guardrails
The access and data controls built into the product, and why they're not configurable away.
These are properties of the system rather than settings. They cannot be turned off from an admin panel, because a guardrail that can be disabled is a default.
Every action re-checks permission
A layout showing you're logged in is not authorization. Every server action re-checks the specific permission it needs, using your role and organization from the session — never from anything the client sends.
Organization data is isolated at the data layer
No function that reads or writes candidate, job, or pipeline data accepts an organization id as an argument — it comes from your session. This isolation is covered by an automated test suite that has to pass before any change ships.
Roles control what each person can see
Owner, Admin, Recruiter, Hiring Manager, Interviewer, Viewer — each role narrows what's visible and what actions are available, and every role is included on every plan.
An audit log for meaningful actions
Actions like publishing a job, moving a candidate, or inviting a member are recorded with who did it and when.
YoHe does not yet use AI to screen, score, or rank candidates. If that changes, it will be documented here before it ships, not after.