# Design the production browser and session boundary

Type: grilling
Status: open

## Question

What same-origin/CSRF, proxy/TLS, security-header, session lifetime,
revocation, secret rotation, and request-timeout contract should the initial
org-admin web surface enforce, and which parts require server-side session state
rather than the current seven-day stateless cookie? Apply the same browser
boundary to ADR-0023's separate server-side Platform Session while preserving
its distinct cookie/token namespace, immediate revocation, per-request grant
reload, and bounded recent-authentication requirement.
