The rules live in the database.

BlueSystem is mine, not a client job: a free, open knowledge base where anyone can write, read and improve practical guides, with real accounts, peer verification and full moderation. It's a demo with no real users, and I'd rather say that than dress it up. It exists to prove the hard part, the machinery a brochure site never has to touch.

The one part that matters: the rules live in the database, not the browser. A user can't promote themselves to admin or edit their own standing even with a hand-crafted request that skips the interface entirely. Every privileged action runs through a database function that logs itself as it happens, so the record and the event can never disagree. That's the checkable version of taking security seriously, rather than a claim about it.