Platform Security

Overview#

Platform Security connects authenticated security evidence, incident investigation and partner coverage in BasaltSurge. This walkthrough visits the six workspaces through read-only navigation. Missing reports and incomplete evidence remain explicit gaps.

Walkthrough#

• Access: Confirm the snapshot and reviewed platform security role.
• Overview and evidence gaps: Read current security activity and completeness before interpreting totals.
• Alerts and incidents: Review incident severity, status and evidence requirements.
• Audit explorer: Investigate redacted events within the intended query window.
• Partner container coverage: Distinguish local observations, authenticated reports and missing telemetry.
• Runtime and operator evidence: Separate observed controls from independent operator attestations.
• Recovery and configuration: Review the incident runbook, logging health and configuration limits.

Takeaway#

Use evidence and source provenance to guide incident response. Keep contained financial flows suspended until independent payment authority, provider recovery and release validation are complete. The tour does not mutate records, export data, sign payments or change configuration.

Actions#

json
[
  {
    "id": "access",
    "title": "Authorized security workspace",
    "brief": "Locate the authenticated snapshot and operator access state.",
    "extended": "Platform Security requires a reviewed platform security role. The visible access state does not grant permission: every API validates the signed session, and sensitive operations additionally require fresh authentication and MFA. Previously loaded data is explicitly marked stale on monitoring failures.",
    "actions": [
      {
        "type": "highlight",
        "resource": {
          "target": "security.panel",
          "source": "src/app/(web)/admin/panels/PlatformSecurityPanel.tsx"
        }
      },
      {
        "type": "highlight",
        "resource": {
          "target": "security.access",
          "source": "src/app/(web)/admin/panels/PlatformSecurityPanel.tsx"
        }
      }
    ]
  },
  {
    "id": "overview",
    "title": "Overview and evidence gaps",
    "brief": "Read current security activity and completeness before interpreting totals.",
    "extended": "The snapshot is platform wide. Quiet event counts do not establish safety: inspect stale or unknown containers, bounded samples, logging failures and controls without passing evidence.",
    "actions": [
      {
        "type": "activate",
        "resource": {
          "target": "security.workspace.overview",
          "source": "src/app/(web)/admin/panels/PlatformSecurityPanel.tsx"
        }
      },
      {
        "type": "highlight",
        "resource": {
          "target": "security.workspace.overview",
          "source": "src/app/(web)/admin/panels/PlatformSecurityPanel.tsx"
        }
      }
    ]
  },
  {
    "id": "alerts",
    "title": "Alerts and incidents",
    "brief": "Review incident severity, status and evidence requirements.",
    "extended": "Acknowledgment keeps an alert active. Resolution requires a ticket and disposition, and concurrent changes require a fresh review. Incident writes require platform security permission and fresh wallet authentication plus MFA. This tour never flags, assigns, resolves or reopens incidents.",
    "actions": [
      {
        "type": "activate",
        "resource": {
          "target": "security.workspace.alerts",
          "source": "src/app/(web)/admin/panels/PlatformSecurityPanel.tsx"
        }
      },
      {
        "type": "highlight",
        "resource": {
          "target": "security.workspace.alerts",
          "source": "src/app/(web)/admin/panels/PlatformSecurityPanel.tsx"
        }
      }
    ]
  },
  {
    "id": "events",
    "title": "Audit explorer",
    "brief": "Investigate redacted events within the intended query window.",
    "extended": "Search and exports cover only the visible bounded page. Local observations differ from signed partner self-reports; source-bound pseudonyms and request IDs prevent partner claims joining central identities. Investigate provenance before attributing an event. This tour performs no export or actor drilldown.",
    "actions": [
      {
        "type": "activate",
        "resource": {
          "target": "security.workspace.events",
          "source": "src/app/(web)/admin/panels/PlatformSecurityPanel.tsx"
        }
      },
      {
        "type": "highlight",
        "resource": {
          "target": "security.workspace.events",
          "source": "src/app/(web)/admin/panels/PlatformSecurityPanel.tsx"
        }
      }
    ]
  },
  {
    "id": "containers",
    "title": "Partner container coverage",
    "brief": "Distinguish local observations, authenticated reports and missing telemetry.",
    "extended": "A local observation describes this server process. A recent signed report authenticates its registered container and preserves self-reported posture; it does not certify the host or provider. Unreported, stale and incomplete streams remain gaps. Remote delivery and independent production monitoring require operator enrollment and evidence.",
    "actions": [
      {
        "type": "activate",
        "resource": {
          "target": "security.workspace.containers",
          "source": "src/app/(web)/admin/panels/PlatformSecurityPanel.tsx"
        }
      },
      {
        "type": "highlight",
        "resource": {
          "target": "security.workspace.containers",
          "source": "src/app/(web)/admin/panels/PlatformSecurityPanel.tsx"
        }
      }
    ]
  },
  {
    "id": "controls",
    "title": "Runtime and operator evidence",
    "brief": "Separate observed controls from independent operator attestations.",
    "extended": "Runtime failures cannot be changed through operator evidence. Attestations require incident tickets and expire to unknown. Suspended Stripe debits and financial workload controls require independent authoritative ledgers and a reviewed code change; a passing ticket or configuration toggle cannot restore contained payments, payouts or refunds.",
    "actions": [
      {
        "type": "activate",
        "resource": {
          "target": "security.workspace.controls",
          "source": "src/app/(web)/admin/panels/PlatformSecurityPanel.tsx"
        }
      },
      {
        "type": "highlight",
        "resource": {
          "target": "security.workspace.controls",
          "source": "src/app/(web)/admin/panels/PlatformSecurityPanel.tsx"
        }
      }
    ]
  },
  {
    "id": "recovery",
    "title": "Recovery and configuration",
    "brief": "Review the incident runbook, logging health and configuration limits.",
    "extended": "Preserve offsite evidence, revoke provider credentials, review persistent authority and routing, then complete independent staging acceptance. Retention and process counters have limited scope. External notification and archive delivery need separate operational evidence. Threshold changes require fresh MFA and a reviewed revision; this tour saves nothing.",
    "actions": [
      {
        "type": "activate",
        "resource": {
          "target": "security.workspace.recovery",
          "source": "src/app/(web)/admin/panels/PlatformSecurityPanel.tsx"
        }
      },
      {
        "type": "highlight",
        "resource": {
          "target": "security.workspace.recovery",
          "source": "src/app/(web)/admin/panels/PlatformSecurityPanel.tsx"
        }
      }
    ]
  }
]