HttpOnly sessions
Browser authentication is stored in secure server-issued cookies rather than localStorage.
SECURITY
Access is a control plane, not an afterthought.
Tenant propagation
Every proxied Viper request carries the configured X-Tenant-Id header.
RBAC ready
Routes and menu surfaces are designed for President, CEO, Director, HR, Finance, Security and Operations roles.
Server proxy boundary
Subsidiary API addresses and credentials remain on the server boundary, reducing client exposure.