# ASP.NET workspace API guide

Create a fresh TeaQL `UserContext` in middleware for every HTTP request. Trusted governance
state comes from server services and claims, never from dynamic JSON. Reject unknown input.