A Token Scoped To One Client Can't Touch Another's Queue
I pointed one client's API token at a different client's queue in production and got a clean 403. The exact schema, the audit that ran before the feature did, and the moment my own tool refused a shortcut I tried to take.