Foundation decisions — 21 October 2026

This release narrows the supplied detailed design to its secure SaaS control plane. The owner's current request supersedes the design's separate-account and separate user-pool defaults. One AWS account and one Cognito pool serve dev and prod, with separate app clients, JWT audiences, memberships, APIs, functions, buckets and tables. The customer-facing website remains at C:/Company/NIXIM/website-v2.

Domains: marketing.nixim.co.uk (prod), marketing-dev.nixim.co.uk (dev), and docs.marketing.nixim.co.uk (documentation). All regional resources are in eu-west-1. CloudFront and Route 53 are global; CloudFront certificates must be in us-east-1.

The first tenant is Nixim. Tenant keys, membership checks and configuration storage support later clients. Public registration is disabled; membership provisioning is an operator task. The eight-stage content pipeline is documented but not activated. No permissions to write existing Nixim or ISS content tables are granted yet.

Cost tags identify Project=marketing-agent, Environment and CostCenter. Shared AWS charges cannot be exactly attributed per tenant by tags. Tenant usage counters are the foundation for later documented allocation estimates; Cost Explorer reports actual tagged platform charges separately. BYO model credentials will use Secrets Manager; this release does not accept or persist provider secrets.

Deployment authorization: the owner's initial request explicitly authorizes creating the repository, infrastructure, user, DNS and both live environments. Rollback uses previous immutable release artifacts; retain data and identity on stack deletion. No existing website stack, content or DNS record is replaced.