Module status page
Security
Permission matrix, action authorization, document upload guard, and Blob-first security audit log.
maturity: MOSTLY_COMPLETEproduction status: production provennavigation status: liveowner: Security policy and audit servicescapability owner: Security
What Is Live
- API route: src/app/api/audit/route.ts
- API route: src/app/api/audit/site/[siteId]/route.ts
- Service: src/lib/security/authorizeSecurityAction.ts
- Service: src/lib/security/recordSecurityAuditEvent.ts
- Adapter: src/lib/operator-command/operatorCommandSecurityAdapter.ts
- Production evidence: Production upload path uses existing document_upload guard.
What Is Not Wired
- Missing critical piece: Session-bound actor resolution for production user identity.
- Known risk: Static UI actor remains a simplification for server action attribution.
Known Blockers
No active blockers are listed.
Next Recommended Action
- Replace static operator actor with authenticated session actor before real multi-user use.
System Audit Evidence
- Readiness score: 85%
- Integration depth: adapter integrated
- Route exposure: none
- Security boundary: clear
- Queue integration: not applicable
- Readiness integration: not applicable
- Workflow integration: wired
- Data Room integration: wired
- Export integration: wired
- Test: src/lib/security/__tests__/securityPermissionMatrix.test.ts
- Test: src/lib/security/__tests__/recordSecurityAuditEvent.test.ts
- Smoke: scripts/smoke-security-operator-command.ts
- Persistence: Vercel Blob-first security audit log with local/tmp fallback.
Architecture Governance
- 11 governance doctrines tracked
- 15 required adapter seams
- 13 forbidden direct couplings
- No high or critical governance findings
Capability Registry
- Read-only Security status page for audit log, authorization, and policy evidence.
- Registry production status: production
- Primary nav group: System
- Capability: system audit maturity
- Capability: security evidence inventory
- Capability: audit log posture
- Capability: safe operator links
Related Links
- Open Operator Command
Security health and denied-action notices surface here.
- Open System Audit
Canonical security maturity and evidence.
Safe Available Actions
- Open System Audit
Canonical module maturity and production readiness.
- Open Architecture Governance
Doctrine and adapter requirements.
- Open registered route
Status/landing route from the capability registry.
- Open Operator Command
Security health and denied-action notices surface here.
- Open System Audit
Canonical security maturity and evidence.
- Source/api/audit/route.ts
API source path listed for visibility only; no action is executed from this page.
- Source/api/audit/site/[siteId]/route.ts
API source path listed for visibility only; no action is executed from this page.
- scripts/smoke-security-operator-command.ts
Smoke script reference; not executed from this page.