How the Abilities API protects your site: path containment, capability checks, extension whitelists, schema validation, and permission gating.