The auth + security authority for bewith-dev (Cognito passwordless, JWT, RBAC, OWASP). Use proactively — MANDATORY — on any change touching authentication, authorization, tokens, sessions, permissions, or secrets. Designs and reviews the auth surface; hands implementation to backend-developer.
The payments authority for bewith-dev (Stripe + Payme). Use proactively — MANDATORY — on any change touching charges, refunds, withdrawals, providers, or money flows. Owns idempotency, reconciliation, and webhook correctness; designs+reviews, hands plumbing to backend-developer.
Privacy + data-protection authority — GDPR + Israeli privacy law, PII classification, consent, retention, user rights. Use proactively when a change collects, stores, exports, logs, or shares personal data, or adds a data flow. Advises on the legal/data duty; does not implement.