# Security & Server Authority

# Security & Server Authority

Trust boundaries for inventory, admin, robbery, links and integrations.

**Applies to:** `Nord Inventory v2.0.0`

Core rules:

- never trust NUI/client item amounts, metadata or permissions without server validation;
- use ACE/server-only license data for administration;
- keep owner-only restore separate from routine admin permissions;
- validate player distance/session identity for remote inventory access;
- validate vehicle lock/movement/range continuously during trunk sessions;
- validate external recommended-script URLs as `http/https` on server and NUI sides;
- use provider ownership for runtime registrations;
- do not expose privileged exports through unrestricted net events.