Access control Operator roles, machine actors and platform-level access safety. Every grant, deny and block below is audited. Console access itself is capability-gated (deny by default).
Sys roles Service accounts & agents Signups & abuse Tenant tiers AuthZ audit
Role catalog (platform-defined, immutable)
sys_support Impersonation with consent, ticket handling, read-only customer base
sys_finance Payouts, invoicing, payment configuration
sys_security Role grants, fraud flags, blocklists, tier changes
sys_operator Deploys, feature flags, operations dashboards
Operator lookup & grant
Operator email Role sys_support sys_finance sys_security sys_operator Grant role
maria.ek@petanque.life
sys_security · sys_support · granted by j.holm 12 May
Revoke jonas.holm@petanque.life
sys_operator · granted by m.ek 3 Apr
Revoke ⛔ Self-grant blocked. You cannot grant a role to your own account — ask a second operator (four-eyes).
🔐 Re-authentication required. Role mutations need a session fresher than 5 minutes.
Re-authenticate Service accounts (M2M, platform scope)
prod-bootstrap
tenants:write · seed:run · 90-day token · IP 10.4.0.0/16
Mint token Revoke status-page-publisher
cms:write · 90-day token · IP —
Mint token Revoke M2M tokens never bind as a human session. Secrets are hash-only server-side and shown once at mint.
Signup queue with fraud signals
boulesud.example (federation)
Turnstile 0.9 · no signals
clean fastclub-x.example (club)
Honeypot + 4 signups same /24 · filled in 3 s
flagged Flag as fraud petanque-mail.example (club)
Blocked email domain
blocked Signals: IP clustering (/24), email-domain repeats, honeypot, fill-time, Turnstile score, payment-decline rate. Flagging opens a SEV3 incident on alert severity.
Email-domain blocklist
Domain Block
petanque-mail.example ✕ disposable-inbox.example ✕ tempbox.example ✕
Rate limiting & abuse monitor
OTP starts / min
412 · under quota
Verify backoff hits (24 h)
38
OIDC authorize / min per IP
cap 10
Enumeration-safe responses; exponential verify backoff with CAPTCHA escalation. Limits are per-IP and per-recipient.
Deny / spoof / block events
capability_denied competition:sanction — clubadmin@nordvik → 403 2 Jul 10:41
tenant_spoof X-Tenant-Id mismatch vs JWT claim — request rejected 2 Jul 09:17
agent_action_blocked finance.payouts.execute — agent tok_a91f (scope block) 1 Jul 16:02
sys.role.grant sys_support → maria.ek (by j.holm, four-eyes) 12 May 09:00
Live stream lands here
Full audit search & retention is delivered by the platform audit pipeline; this view reads it.
