Local production controls
Security & Reports
Session Controls
Request IDnone
Expirestoken
Lockout0m
Failures0
Protected Exports
Session Policy
Operational routes require a local token or expiring session.
API tokens are matched by hash and denied with constant-time comparison.
Repeated failed auth attempts create security events and short lockouts.
Token Rotation Plan
| Actor | Role | New fingerprint |
|---|
Active Sessions
admin| Actor | Role | Fingerprint | Expires |
|---|
Security Events
admin| Time | Type | Actor | Fingerprint |
|---|
Rate Limit Buckets
admin| Actor | Requests | Resets |
|---|
Audit Trail
analyst| Time | Actor | Action | Entity |
|---|