Multi-Tenant Client Isolation
Every client is strictly separated, with its own devices, schedules, retention policies and user permissions. No client can ever see another client's data, and we treat that as the highest-consequence thing we could get wrong.