What is real, what is synthetic, what is not built.

• Public marketing site

  Running

  Static, P0 content only

• Synthetic workspace

  Running

  17 modules, API-backed, synthetic tenant

• Governed API

  Running

  Access ladder enforced server-side

• Live source integrations

  Not built

  All connectors are mock adapters

• Write-back to source systems

  Disabled

  By default, in both API and data model

• Sign-in and sessions

  Running

  Real credential check; access level derived from the assignment

• Organisation SSO

  Running

  Odoo is the identity provider and assignment authority

• MFA / recovery

  Not built

  A tenant's own identity provider would enforce these

• Lead routing / CRM

  Not connected

  Forms validate and stop

• TLS on the demo host

  Not configured

  Plain HTTP on an IP; needs a domain

Gate status is unchanged by anything on this page: no live source integrations, no real tenant data, write-back disabled. Treat it as a working demonstration of governed patterns.