# Crafting Security Model

Nord Crafting keeps the important decisions server-side.

## Validations

The server checks:

- Valid request payload.
- Existing bench instance.
- Player distance from bench.
- Bench access policy.
- Recipe assignment to the bench.
- Recipe existence.
- Required crafting level.
- Required blueprint and remaining uses.
- Ingredient counts.
- Weapon/component compatibility in weapon workflows.

## Server authority

Inventory removal and output addition are performed through the server inventory bridge. The client/NUI is used for presentation and input, not for authoritative item grants.

## Anti-race/craft locking

Crafting maintains per-player craft lock state to reduce spam and overlapping craft operations.

## Recommended production rule

Do not expose custom events that bypass `GetBenchOpenPayload`, access validation or the normal crafting handlers. If another script needs to open a bench, use the public exports documented in the Developer API chapter.