Business operations stay inside the authenticated tenant context.
Authorization comes from the server, not the browser.
Tenant membership, role, permissions and database scope remain authoritative even when the user interface changes.
Business, reseller and platform scopes have different landing pages and navigation.
Hashed session tokens, CSRF protection and 2FA foundations remain part of the application.
The marketing site has no direct business repository or tenant database authority.