Restricted cloud access

Operator-selected mode: local-only. Modes are selected by server configuration, never by browser-provided authorization flags.

• Local-only (default): every human and machine remote integration is disabled.
• Supabase: only existing confirmed users in the owner-controlled email allowlist may authenticate, then request agent approval. No signup or legacy account restoration.
• Cloudflare Access: signed application JWT verified against configured team keys, issuer, audience and expiry, then exact email allowlist. Agent service identity has separate rules.

Authentication alone never approves cloud use. Agent-reviewed grants last at most one hour, are scope-bound and revocable. No approval credential is available in this console.