Skip to main content

8. Organization Operations & Governance Backbone

Functional Documentation​

1) Purpose​

This layer governs:

  • who can operate systems
  • how org-wide settings are controlled
  • how credentials and integrations are managed
  • how evidence is exported for audit/compliance workflows

It is the operational governance backbone connecting day-to-day administration with evidentiary traceability.

2) Team / Member Management (Org-Level Roles)​

Scope: Settings -> Team Members

What it provides:

  • Role-aware access model (owner, admin, member, operator).
  • Invitation, role change, and member removal lifecycle.
  • Access propagation across organization/system/customer scopes.
  • Immutable audit records for high-impact actions.

Main actions:

  • Invite User
  • Save (role row)
  • Remove
  • Copy link (manual invite delivery fallback)

Control model:

  • Owners/admins manage membership.
  • Elevated role transitions are constrained by role policy.

3) Organization Settings & Metadata​

Scope:

  • Settings -> Organization
  • Settings -> Organization Metadata

What it provides:

  • Organization identity management.
  • Legal and governance metadata used in compliance/reporting context.
  • Owner/admin restricted writes.
  • Auditable update history.

Main actions:

  • Save (organization name)
  • Save metadata (legal entity, country, compliance contact)

4) API Key Lifecycle (Generation, Hashing, Rotation/Revocation)​

Scope: System -> Integration (per system)

What it provides:

  • API key generation with one-time raw-key reveal.
  • Server-side storage of key prefix and secure hash only.
  • Environment and ownership metadata (dev/staging/prod, owner label).
  • Active/revoked state visibility and key usage timestamps.
  • Backend lifecycle actions for revoke and stale-key control.

Security implementation model:

  • Pepper-based hashing with versioned digest format.
  • Candidate hash support for zero-downtime pepper rotation.
  • Raw key is not recoverable after generation screen.

Main actions:

  • Generate Key
  • Copy (raw key)
  • Open Step-by-Step Setup Guide
  • Setup guide controls: Back, Next, Finish

5) Webhook Integrations (Downstream Notifications / SIEM)​

Scope: System -> Settings -> SIEM (shared webhook panel)

What it provides:

  • HTTPS-only webhook endpoints.
  • Per-endpoint secret management.
  • Event routing flags for alert/block delivery.
  • Active/disabled endpoint control.
  • Built-in delivery test workflow.
  • Signed request headers for verification and correlation.

Main actions:

  • Add webhook
  • Auto-generate (secret)
  • Save changes
  • Edit
  • Test webhook
  • Delete / Delete webhook
  • Cancel

6) Audit / Report / Compliance Export Workflows​

What it provides:

  • Global immutable audit trail across systems.
  • System-level evidence export for operational and regulatory use.
  • Event-level and timeline-level data export.
  • Annex-style report generation and PDF export.

Main actions:

  • Export Bundle
  • Export -> Export as CSV / Export as JSON
  • Export JSON (single event detail)
  • Generate Report / Regenerate Report Data
  • Download PDF

7) Governance Notes​

  • Admin controls are RBAC-gated by design.
  • Operational mutations (keys, webhooks, membership, org metadata) are audit-logged.
  • The backbone separates operational control from immutable compliance evidence, preserving forensic integrity and regulatory defensibility.