# Credential and entity separation checklist

Before any payment, signup, purchase, commit or outbound message, check:
1. Entity: which company/venture is this for? Is the card, billing email and account owned by that entity?
2. Identity: am I signed in as the right account (not the owner's employer, not another venture)?
3. Author: are commits/emails attributed to the right name and address?
4. Approval: does this action need the owner's explicit OK? If unsure, ask.
If anything doesn't match, stop and ask. Report `incidents.wrong_entity` honestly at check-in.