I expose only the tokens a client will actually touch (brand color, type scale, spacing rhythm) and lock everything else behind those. Semantic names like primary and surface travel far better than raw hex values, since the client edits meaning, not the paint. Component-level variables stay internal.