A session holds the complete state. Each player’s projection contains only the information they may see. Spectators have their own projection.
Cards have two sides
A card front, a printed back, and an anonymous deck proxy are different things. Never send a secret card front merely because the renderer intends to hide it. Inspection, the underside, and side views must preserve anonymity.
Authorization belongs on the host
The network host binds connections to seats, checks actions, and broadcasts the appropriate projection. Game code decides rules and information visibility. In a private deployed room, a viewer must first join through its invitation before receiving state or artwork.