Principles
A principle is only worth stating if it decides behaviour at the moment of failure. Each of these is written as the rule the code follows when a dependency is unavailable, a session cannot be verified, or a record cannot be written.
When a system cannot establish that an action is permitted, it refuses the action.
Access is denied by default. A missing provider, an unreachable audit store or an unverifiable session all produce refusal — never a quiet grant. Degrading into permissiveness is the one failure mode we do not accept.
A claim that cannot be verified by a machine is not a claim the platform makes.
Release gates run as audits that fail the build. Capability states are read from the running system rather than written into documentation and left to rot.
Every fact has exactly one authoritative home, and everything else reads from it.
Content, configuration and schema are defined once and consumed. Duplication is treated as a defect, because two copies of a fact are two chances to be wrong.
A connection to a datastore is not authorization to change what is in it.
Writes require a verified session, durable persistence and durable audit together. If any one of the three is unavailable, the write is refused rather than performed unrecorded.
The separation between planes and between businesses is the architecture, not decoration.
Each plane owns its concern and exposes a contract. One business's incident stays one business's incident because the boundary is enforced by the platform.
Anything that can be shipped forward can be taken back.
Releases are promoted from verified artefacts and can be rolled back to a known-good one. Schema changes are applied as ordered, re-runnable migrations.
In practice
Each principle above is owned by one or more of the five planes, and is enforced by the platform rather than left to the convention of whoever is writing the service.