# Security Model

Nord Vehicle Keys is designed around server authority.

## Important protections

- OneSync entity checks are required by default.
- Lock state is synchronized through entity state bags.
- Key grants/removals are validated server-side.
- Physical key metadata is re-read from the authoritative inventory slot.
- Session/stolen keys are bound to the player connection/session token.
- Carjacking actions use server-side action reservation and validation.
- Ownership lookup is server-side.
- Recovery keys are only issued after ownership validation.
- Admin actions use ACE permission checks.
- Sensitive compatibility events are disabled by default.
- Callback/action rate limits reduce spam and replay abuse.

## Trusted export rule

Exports such as `GiveKeys` should only be called by trusted server resources after that resource has validated its own business logic.