Management console

Access

The console is a browser application served by the console service at /console/ on the same HTTPS origin as the API. Its content security policy allows nothing but itself, and it cannot be framed.

Local accounts. No self-registration; the first account is created with the bootstrap key, further accounts by a platform administrator. Passwords are at least 12 characters. Five failed attempts lock an account for 15 minutes. Sessions are server-side, last 24 hours, and ride on a cookie that is secure, HTTP-only and strict same-site, with CSRF protection.

Enterprise identity. One identity provider can be active per deployment, OIDC, SAML 2.0 or LDAP, mapping the user’s direct groups to console roles; external sessions last at most 8 hours. Nested groups are not expanded. Compatibility with a customer’s directory (for example Entra ID or Active Directory) is validated during the pilot as part of the deployment.

Roles

Role	Can
platform_admin	Everything, across tenants: tenants, users, keys, global rules, identity provider
tenant_admin	Users and keys within one tenant
developer	Playground and API keys for development in the tenant
rule_manager	Create, test, publish and disable custom rules for the tenant
reviewer	Review captured detection runs and record feedback

API keys for machines have their own three roles; see Keys and tenants.

Screens

• Tenants. Create and suspend tenants, set rate limits.
• API keys. Issue, rotate, disable and revoke keys with route permissions and source allow-lists; every action needs a reason.
• Users. Console accounts and their roles.
• Detection playground. Run the full pipeline on pasted text and inspect every span.
• Detection rules. Custom regular-expression rules with category, confidence and lifecycle, tested in place before publishing. Published rules apply at the next request.
• Detection reviews. Captured runs with the encrypted original, per-span verdicts, missed-span marking, and reviewed precision over 24 hours and 7 days. Feedback exports as JSON.
• Enterprise identity. Provider configuration and group-to-role mapping.

The interface is in English; dates follow Turkish conventions.

Evidence

Console actions are recorded in an event table in the same database transaction as the change itself, so the record cannot be out of step with the state. API-key management writes an immutable event with the reason given. Both tables are yours to query and export.