This is the fourteenth post in the Meet Horizon UI series, and it opens Act 4 — govern & secure it . Everything so far was about what Horizon shows and does ; this post is about who gets to see and do it . And one architectural point matters up front: all of this — RBAC, authentication, the audit log, break-glass, themes — is Horizon’s own governance, enforced in its BFF , and it does not touch the OAP admin host.