Data and Ownership Boundaries

Ownership Table

System	Owns	Does NOT own
news-server	Auth decisions, data validation, article state, publish eligibility, API access control	UI presentation, form UX, reader experience
news-client	Editorial UI, form inputs, route guards, moderation views, operator actions	Article state transitions, auth token signing
child-sites	Reader UI, content presentation, branded styling	Any editorial or admin state
MongoDB	Canonical system-of-record data	None — it is storage only

Responsibility Handoffs

1. news-client collects user intent (create, edit, publish, manage).
2. news-server validates the role and whether the action is allowed.
3. news-server writes the final state to MongoDB.
4. child-sites read and display published data — they never write editorial state.

Note

If you are unsure whether a validation or business rule belongs in the frontend or backend: put it in the backend. The dashboard can duplicate it for UX, but the backend is the authority.