At a glance
Verify cross-tenant isolation
Test restoration, not just backup creation
Protect secrets and privileged operations
Review failure paths before public access
Identity and authorization
Project mutations require verified platform identity, organization membership and auditability. Row-level database authorization is tested separately from control-plane permissions.
Data and storage
Per-project database boundaries, least-privileged REST, signed storage access, stream authorization and tested restore workflows are required before they are offered publicly.
Operations
Metering, observability, incident handling, budgets and security testing are defined as release conditions rather than after-launch enhancements.