architecture-decision-record
ADR: Why Our Cloud Agent Runs Behind a Privilege Boundary Instead of on the Public Web Server
When you run 25+ services on a single VPS — including an AI agent that can read your CRM, trigger outbound emails, and execute code — the question of where that agent lives relative to your public website isn't academic. It's the single most consequential infrastructure decision you&