Identity, secret custody and detection in one plane — Identity (SS-01), Vault (SS-05) and SecOps (SS-28). Findings route into cases; keys are custodied, never stored in an app.
| Item | Kind | Detail | Severity | Status |
|---|---|---|---|---|
| Identity (SS-01)SS-01 | Provider | OIDC · 12 users · 4 groups · MFA seam | — | healthy |
| transit-auditSS-05 | Signing key | Vault Transit · rotated 6d ago | — | active |
| db-orders-roleSS-05 | Dynamic cred | Leased · TTL 1h · auto-rotated | — | active |
| Unsigned image blockedSS-28 | Finding | Registry admission denied worker-pool:sha-9f2 | high | open |
| Anomalous loginSS-28 | Finding | SecOps flagged new-geo sign-in · contained | medium | open |
| SOC2 control CC6.1SS-34 | Control | GRC evidence attached · passing | low | healthy |
Multi-factor auth is not yet in the SS-01 contract, so this is a single labelled seam rather than a mock flow. When it ships, enrollment appears here and under Account · Security.