# Mocking

Mocks are development-only, typed, isolated, explicit, and replaceable.

Do not put fake API behavior into production pages.

Mocks exist for development and demo only. They must never:
- bypass or fake backend security (auth, authorization, input validation)
- trust client-supplied prices, totals, or permissions as authoritative
- represent themselves as the real backend contract

Per AGENTS.md, mock behavior is replaceable: the real API replaces it through
the centralized Axios client / env switch without touching page components.