Vault administration
The per-vault admin console is where an engagement's administrator
manages compartments, user accounts and their grants, reviews
quarantined uploads, and adjusts the vault's configurable settings.
The console holds no power of its own: every act travels the same
verified, audited data access layer as any other request, the vault's
engine re-checks admin authority on every write, and the set of
configurable settings is a closed list — the console can never be
talked into storing a setting the vault does not know. The vault is
also local-first: it refuses to start at all if its model endpoint
points outside the deployment, unless the operator has explicitly
accepted that egress — and then every model call is put on the record.
The console refuses a visitor who is not an administrator
- Given a console whose vault denies its visitor
- When the visitor opens the console's settings page
- Then the console refuses with no detail
A setting outside the vault's vocabulary is refused
- Given the admin console
- When an administrator stores a setting the vault does not know
- Then the console refuses the setting as invalid
The vault refuses to start when its model lives outside the deployment
- Given a deployment whose model endpoint points outside the deployment
- When the vault checks its model endpoint at start
- Then the start is refused
An explicit operator override puts model calls on the record
- Given a deployment whose model endpoint points outside the deployment
- And the operator has explicitly accepted non-local model egress
- When the vault checks its model endpoint at start
- Then the vault proceeds with every model call marked for audit
Disabling an account blocks new sessions immediatelystack
- Given a vault administrator and a member account
- When the administrator disables the member's account through the console
- Then the vault refuses to issue the member a new session
A member cannot administer the vaultstack
- Given a vault administrator and a member account
- When the member tries to read the console's settings
- Then the console refuses with no detail