Identity and role access
Signed-in access, configured users, roles, permissions, business context, and owner-only controls limit what each person can view or change.
Security, controls and reliability
Automation should reduce work—
Automation should reduce work—
not remove accountability.
Highway 38 is designed around controlled access, connected records, approval gates, proof, error visibility, backups, deployment verification, and explicit limits on customer-facing or financial actions.
Plain-language rule
AI and automation may prepare internal work. People remain responsible for final approval, verified data, customer commitments, regulated decisions, and money movement.
Core protection model
Controls are built into the workflow instead of added after a problem.
Business and customer isolation
Customer records, business configuration, storage, deployment references, and permissions are kept within the correct business context rather than mixed into a shared public workspace.
Controlled external actions
Customer messages, final quote delivery, scheduling commitments, purchasing, invoice delivery, payments, payroll, tax filing, publishing, and deployments remain owner-controlled unless explicitly approved and verified.
Proof and audit history
Approvals, important changes, evidence, errors, and controlled actions can be recorded so the business can understand what happened and why.
Backups and rollback
Production changes preserve existing identifiers and records where required, create backup or rollback references, and verify the exact deployed source instead of assuming a merge equals a successful launch.
Fail-closed boundaries
Security, destructive actions, data integrity, and deployment controls are intended to stop when required evidence is missing rather than silently continuing.
H38 AI boundaries
Useful assistance with visible human responsibility.
AI can organize notes, draft scopes, summarize records, identify gaps, compare options, and recommend next actions.
Official prices, costs, labor rates, dimensions, code requirements, specifications, accounting treatment, legal conclusions, and regulated professional decisions require verified sources.
Advanced photo measurement and quantity work requires references, field dimensions, appropriate tools, or professional verification.
AI output is not treated as customer approval, authorization to proceed, payment permission, or a substitute for qualified judgment.
No unlimited claims
Highway 38 does not describe AI, storage, support, processing, integrations, availability, or third-party services as unlimited. Included use and special processing are defined by the product level and approved scope.
Deployment reliability
Public pages and the signed-in application are treated as separate production systems.
Public website
Source checks, route checks, links, images, accessibility, mobile rendering, deployment evidence, and live-page verification protect the customer-facing site.
Business Office web app
Authentication, permissions, module contracts, startup behavior, records, deployment IDs, app verification, and owner-controlled actions are protected separately from public website changes.
Customer portals and integrations
Portal access, customer-visible records, messages, approvals, payments, and connected services require their own security boundary and acceptance checks.
Operational transparency
What customers should ask before launch.
Who can access what?
Confirm users, roles, owner access, support access, customer access, and how access is removed.
Which actions can happen automatically?
Confirm every action that can contact a customer, create a commitment, move money, purchase, publish, schedule, deploy, or alter important records.
What is backed up and recoverable?
Confirm the business records, files, settings, deployment references, backup frequency, and rollback process included in the approved implementation.
What depends on third parties?
Google, email, payment, domain, messaging, accounting, mapping, AI, and other connected services have their own terms, outages, limits, and security responsibilities.
Security claims should match the exact implementation.
Product scope, connected services, access rules, backup behavior, approval gates, and launch evidence are reviewed before production use.