A fictional team uses a website and a mobile app to update shared tasks.
Each task has a title, an owner and a status. Only authorised people may
change it, and both interfaces should show the same recorded outcome.

In three sentences, explain:
1. Where should the permission and update rules live?
2. Which record should both interfaces use?
3. How should the interfaces learn that a task has changed?