Service
Build Mode integrations obtain owner-bound session and broker capabilities
through BuildService. The service requires a host-authenticated session
before exposing those capabilities and rejects attempts to create or mutate
sessions for another owner.