Access is restricted to the env-configured Devout admin and enforced server-side. All access attempts are audit logged.