An app is the product layer of Xema, owned by app-platform-api. It picks a set of biomes, wires them into a coherent UX, and may add its own UI shell or backend service. Apps consume capabilities through the same gateway that agents and the shell use — there is no private back door. Apps may register app-client records to support delegated-session flows where an external (non-Xema) caller acts on behalf of a Xema audience; the delegated JWT is signed by a rotating key ring (ES256 / RS256) and carries { appId, sub, act, org, project, session, environment, capabilities, exp, jti, tokenClass }. Every public ingress door takes an app-client credential and is capped by both a per-client and (where a subject exists) a per-subject hourly rate limit. The public ingress (app-platform-public.xema.dev) is split from the org-internal admin ingress so platform AuthGuard is bypassed only on /public/* paths. External-subject sessions are reachable through the embedded route /embedded/session/:token. See the Apps page for the full model, the endpoint surface, and the embed snippet.