"use strict"; const {Fragment: _Fragment, jsx: _jsx, jsxs: _jsxs} = arguments[0]; const {useMDXComponents: _provideComponents} = arguments[0]; function _createMdxContent(props) { const _components = { a: "a", br: "br", div: "div", h1: "h1", h2: "h2", h3: "h3", hr: "hr", li: "li", mermaid: "mermaid", ol: "ol", p: "p", path: "path", strong: "strong", svg: "svg", table: "table", tbody: "tbody", td: "td", th: "th", thead: "thead", tr: "tr", ul: "ul", ..._provideComponents(), ...props.components }; return _jsxs(_Fragment, { children: [_jsxs(_components.h1, { id: "stayconnect-portal---security--access-control", children: [_jsx(_components.a, { className: "heading-link", href: "#stayconnect-portal---security--access-control", children: _jsx(_components.svg, { xmlns: "http:www.w3.org/2000/svg", fill: "#ab2b65", viewBox: "0 0 20 20", className: "w-5 h-5", children: _jsx(_components.path, { fillRule: "evenodd", clipRule: "evenodd", d: "M9.493 2.853a.75.75 0 00-1.486-.205L7.545 6H4.198a.75.75 0 000 1.5h3.14l-.69 5H3.302a.75.75 0 000 1.5h3.14l-.435 3.148a.75.75 0 001.486.205L7.955 14h2.986l-.434 3.148a.75.75 0 001.486.205L12.456 14h3.346a.75.75 0 000-1.5h-3.14l.69-5h3.346a.75.75 0 000-1.5h-3.14l.435-3.147a.75.75 0 00-1.486-.205L12.045 6H9.059l.434-3.147zM8.852 7.5l-.69 5h2.986l.69-5H8.852z" }) }) }), "StayConnect Portal - Security & Access Control"] }), "\n", _jsxs(_components.p, { children: [_jsx(_components.strong, { children: "Date:" }), " December 15, 2025", _jsx(_components.br, {}), "\n", _jsx(_components.strong, { children: "Version:" }), " 1.0", _jsx(_components.br, {}), "\n", _jsx(_components.strong, { children: "Author:" }), " Nicko Goodwin, Goodwin Software LLC", _jsx(_components.br, {}), "\n", _jsx(_components.strong, { children: "Status:" }), " Draft"] }), "\n", _jsx(_components.hr, {}), "\n", _jsxs(_components.h2, { id: "1-overview", children: [_jsx(_components.a, { className: "heading-link", href: "#1-overview", children: _jsx(_components.svg, { xmlns: "http:www.w3.org/2000/svg", fill: "#ab2b65", viewBox: "0 0 20 20", className: "w-5 h-5", children: _jsx(_components.path, { fillRule: "evenodd", clipRule: "evenodd", d: "M9.493 2.853a.75.75 0 00-1.486-.205L7.545 6H4.198a.75.75 0 000 1.5h3.14l-.69 5H3.302a.75.75 0 000 1.5h3.14l-.435 3.148a.75.75 0 001.486.205L7.955 14h2.986l-.434 3.148a.75.75 0 001.486.205L12.456 14h3.346a.75.75 0 000-1.5h-3.14l.69-5h3.346a.75.75 0 000-1.5h-3.14l.435-3.147a.75.75 0 00-1.486-.205L12.045 6H9.059l.434-3.147zM8.852 7.5l-.69 5h2.986l.69-5H8.852z" }) }) }), "1. Overview"] }), "\n", _jsx(_components.p, { children: "This document defines the security architecture and access control model for the StayConnect IoT Device Management Portal. The security model is built on the principle of least privilege with strict boundaries between internal infrastructure management and customer-facing functionality." }), "\n", _jsxs(_components.h3, { id: "key-security-principles", children: [_jsx(_components.a, { className: "heading-link", href: "#key-security-principles", children: _jsx(_components.svg, { xmlns: "http:www.w3.org/2000/svg", fill: "#ab2b65", viewBox: "0 0 20 20", className: "w-5 h-5", children: _jsx(_components.path, { fillRule: "evenodd", clipRule: "evenodd", d: "M9.493 2.853a.75.75 0 00-1.486-.205L7.545 6H4.198a.75.75 0 000 1.5h3.14l-.69 5H3.302a.75.75 0 000 1.5h3.14l-.435 3.148a.75.75 0 001.486.205L7.955 14h2.986l-.434 3.148a.75.75 0 001.486.205L12.456 14h3.346a.75.75 0 000-1.5h-3.14l.69-5h3.346a.75.75 0 000-1.5h-3.14l.435-3.147a.75.75 0 00-1.486-.205L12.045 6H9.059l.434-3.147zM8.852 7.5l-.69 5h2.986l.69-5H8.852z" }) }) }), "Key Security Principles"] }), "\n", _jsxs(_components.ul, { children: ["\n", _jsxs(_components.li, { children: [_jsx(_components.strong, { children: "Role-Based Access Control (RBAC)" }), " with configurable permissions"] }), "\n", _jsxs(_components.li, { children: [_jsx(_components.strong, { children: "Multi-tenant data isolation" }), " with hierarchical organization support"] }), "\n", _jsxs(_components.li, { children: [_jsx(_components.strong, { children: "Critical security boundary" }), ": Customers have NO access to SIM Bank infrastructure"] }), "\n", _jsxs(_components.li, { children: [_jsx(_components.strong, { children: "Comprehensive audit logging" }), " of all user actions"] }), "\n", _jsxs(_components.li, { children: [_jsx(_components.strong, { children: "Principle of least privilege" }), " applied to all access controls"] }), "\n"] }), "\n", _jsx(_components.hr, {}), "\n", _jsxs(_components.h2, { id: "2-role-based-access-control-rbac-matrix", children: [_jsx(_components.a, { className: "heading-link", href: "#2-role-based-access-control-rbac-matrix", children: _jsx(_components.svg, { xmlns: "http:www.w3.org/2000/svg", fill: "#ab2b65", viewBox: "0 0 20 20", className: "w-5 h-5", children: _jsx(_components.path, { fillRule: "evenodd", clipRule: "evenodd", d: "M9.493 2.853a.75.75 0 00-1.486-.205L7.545 6H4.198a.75.75 0 000 1.5h3.14l-.69 5H3.302a.75.75 0 000 1.5h3.14l-.435 3.148a.75.75 0 001.486.205L7.955 14h2.986l-.434 3.148a.75.75 0 001.486.205L12.456 14h3.346a.75.75 0 000-1.5h-3.14l.69-5h3.346a.75.75 0 000-1.5h-3.14l.435-3.147a.75.75 0 00-1.486-.205L12.045 6H9.059l.434-3.147zM8.852 7.5l-.69 5h2.986l.69-5H8.852z" }) }) }), "2. Role-Based Access Control (RBAC) Matrix"] }), "\n", _jsx(_components.mermaid, { config: "{}", chart: "graph TB\n subgraph \"Internal Roles\"\n ADMIN[Admin
Full System Access]\n SUPPORT[Support Staff
Troubleshooting + SIM Bank]\n OPERATIONS[Operations
Billing + Inventory]\n FULFILLMENT[Fulfillment
Shipping + Device Management]\n end\n \n subgraph \"External Roles\"\n ACCOUNT_OWNER[Account Owner
Full Customer Access]\n MANAGER[Manager
Limited Customer Management]\n USER[User
Basic Device Access]\n READ_ONLY[Read-Only
View Only]\n end\n \n subgraph \"Access Capabilities\"\n subgraph \"Internal Infrastructure\"\n SIM_BANK_ACCESS[SIM Bank Management]\n PROVIDER_CREDS[Provider Credentials]\n SYSTEM_SETTINGS[System Configuration]\n end\n \n subgraph \"Provider API Access\"\n PROVIDER_DATA[Provider Usage/Billing]\n DEVICE_CONTROL[Device Actions]\n CUSTOMER_MGMT[Customer Management]\n end\n \n subgraph \"Business Operations\"\n BILLING[Invoice Generation]\n REPORTING[Advanced Reporting]\n INVENTORY[Inventory Management]\n end\n end\n \n ADMIN --> SIM_BANK_ACCESS\n ADMIN --> PROVIDER_CREDS\n ADMIN --> SYSTEM_SETTINGS\n ADMIN --> PROVIDER_DATA\n ADMIN --> DEVICE_CONTROL\n ADMIN --> CUSTOMER_MGMT\n ADMIN --> BILLING\n ADMIN --> REPORTING\n ADMIN --> INVENTORY\n \n SUPPORT --> SIM_BANK_ACCESS\n SUPPORT --> PROVIDER_DATA\n SUPPORT --> DEVICE_CONTROL\n SUPPORT --> CUSTOMER_MGMT\n \n OPERATIONS --> PROVIDER_DATA\n OPERATIONS --> BILLING\n OPERATIONS --> REPORTING\n OPERATIONS --> INVENTORY\n \n FULFILLMENT --> INVENTORY\n FULFILLMENT -->|Limited| PROVIDER_DATA\n \n ACCOUNT_OWNER --> PROVIDER_DATA\n ACCOUNT_OWNER -->|Own Org| CUSTOMER_MGMT\n ACCOUNT_OWNER -->|Own Org| BILLING\n ACCOUNT_OWNER -->|Own Org| REPORTING\n \n MANAGER --> PROVIDER_DATA\n MANAGER -->|Limited| CUSTOMER_MGMT\n MANAGER -->|View Only| BILLING\n \n USER --> PROVIDER_DATA\n USER -->|Limited| DEVICE_CONTROL\n \n READ_ONLY -->|View Only| PROVIDER_DATA\n \n %% Security Boundaries\n SIM_BANK_ACCESS -.->|NO ACCESS| ACCOUNT_OWNER\n SIM_BANK_ACCESS -.->|NO ACCESS| MANAGER\n SIM_BANK_ACCESS -.->|NO ACCESS| USER\n SIM_BANK_ACCESS -.->|NO ACCESS| READ_ONLY\n \n PROVIDER_CREDS -.->|NO ACCESS| ACCOUNT_OWNER\n PROVIDER_CREDS -.->|NO ACCESS| MANAGER\n PROVIDER_CREDS -.->|NO ACCESS| USER\n PROVIDER_CREDS -.->|NO ACCESS| READ_ONLY\n \n SYSTEM_SETTINGS -.->|NO ACCESS| ACCOUNT_OWNER\n SYSTEM_SETTINGS -.->|NO ACCESS| MANAGER\n SYSTEM_SETTINGS -.->|NO ACCESS| USER\n SYSTEM_SETTINGS -.->|NO ACCESS| READ_ONLY\n\n classDef internal fill:#f1f8e9,stroke:#33691e\n classDef external fill:#e1f5fe,stroke:#01579b\n classDef internal_cap fill:#fce4ec,stroke:#880e4f\n classDef provider_cap fill:#e0f7fa,stroke:#006064\n classDef business_cap fill:#fff3e0,stroke:#e65100\n classDef boundary stroke:#ff0000,stroke-width:2px,stroke-dasharray:5 5\n \n class ADMIN,SUPPORT,OPERATIONS,FULFILLMENT internal\n class ACCOUNT_OWNER,MANAGER,USER,READ_ONLY external\n class SIM_BANK_ACCESS,PROVIDER_CREDS,SYSTEM_SETTINGS internal_cap\n class PROVIDER_DATA,DEVICE_CONTROL,CUSTOMER_MGMT provider_cap\n class BILLING,REPORTING,INVENTORY business_cap" }), "\n", _jsxs(_components.h3, { id: "role-definitions", children: [_jsx(_components.a, { className: "heading-link", href: "#role-definitions", children: _jsx(_components.svg, { xmlns: "http:www.w3.org/2000/svg", fill: "#ab2b65", viewBox: "0 0 20 20", className: "w-5 h-5", children: _jsx(_components.path, { fillRule: "evenodd", clipRule: "evenodd", d: "M9.493 2.853a.75.75 0 00-1.486-.205L7.545 6H4.198a.75.75 0 000 1.5h3.14l-.69 5H3.302a.75.75 0 000 1.5h3.14l-.435 3.148a.75.75 0 001.486.205L7.955 14h2.986l-.434 3.148a.75.75 0 001.486.205L12.456 14h3.346a.75.75 0 000-1.5h-3.14l.69-5h3.346a.75.75 0 000-1.5h-3.14l.435-3.147a.75.75 0 00-1.486-.205L12.045 6H9.059l.434-3.147zM8.852 7.5l-.69 5h2.986l.69-5H8.852z" }) }) }), "Role Definitions"] }), "\n", _jsx(_components.p, { children: _jsx(_components.strong, { children: "Internal Roles:" }) }), "\n", _jsxs(_components.ul, { children: ["\n", _jsxs(_components.li, { children: [_jsx(_components.strong, { children: "Admin" }), ": Full system access including SIM Bank management, provider credentials, and system configuration"] }), "\n", _jsxs(_components.li, { children: [_jsx(_components.strong, { children: "Support Staff" }), ": Troubleshooting access including SIM Bank management, device controls, and customer management"] }), "\n", _jsxs(_components.li, { children: [_jsx(_components.strong, { children: "Operations" }), ": Billing, reporting, and inventory management"] }), "\n", _jsxs(_components.li, { children: [_jsx(_components.strong, { children: "Fulfillment" }), ": Shipping and limited device/inventory management"] }), "\n"] }), "\n", _jsx(_components.p, { children: _jsx(_components.strong, { children: "External Roles (Customer-Facing):" }) }), "\n", _jsxs(_components.ul, { children: ["\n", _jsxs(_components.li, { children: [_jsx(_components.strong, { children: "Account Owner" }), ": Full access to own organization's provider data, customer management, billing, and reporting"] }), "\n", _jsxs(_components.li, { children: [_jsx(_components.strong, { children: "Manager" }), ": Limited customer management with view-only billing access"] }), "\n", _jsxs(_components.li, { children: [_jsx(_components.strong, { children: "User" }), ": Basic device access and monitoring"] }), "\n", _jsxs(_components.li, { children: [_jsx(_components.strong, { children: "Read-Only" }), ": View-only access to provider data"] }), "\n"] }), "\n", _jsx(_components.hr, {}), "\n", _jsxs(_components.h2, { id: "3-multi-tenant-organization-hierarchy", children: [_jsx(_components.a, { className: "heading-link", href: "#3-multi-tenant-organization-hierarchy", children: _jsx(_components.svg, { xmlns: "http:www.w3.org/2000/svg", fill: "#ab2b65", viewBox: "0 0 20 20", className: "w-5 h-5", children: _jsx(_components.path, { fillRule: "evenodd", clipRule: "evenodd", d: "M9.493 2.853a.75.75 0 00-1.486-.205L7.545 6H4.198a.75.75 0 000 1.5h3.14l-.69 5H3.302a.75.75 0 000 1.5h3.14l-.435 3.148a.75.75 0 001.486.205L7.955 14h2.986l-.434 3.148a.75.75 0 001.486.205L12.456 14h3.346a.75.75 0 000-1.5h-3.14l.69-5h3.346a.75.75 0 000-1.5h-3.14l.435-3.147a.75.75 0 00-1.486-.205L12.045 6H9.059l.434-3.147zM8.852 7.5l-.69 5h2.986l.69-5H8.852z" }) }) }), "3. Multi-Tenant Organization Hierarchy"] }), "\n", _jsx(_components.mermaid, { chart: "graph TB\n ROOT[StayConnect
Root Organization]\n \n subgraph \"Reseller Hierarchy Example\"\n RESELLER_A[Reseller A
Parent Organization]\n RESELLER_B[Reseller B
Parent Organization]\n \n subgraph \"Reseller A Customers\"\n CUST_A1[Customer A1
Child Organization]\n CUST_A2[Customer A2
Child Organization]\n \n subgraph \"Customer A1 Sub-Customers\"\n SUB_A1_1[Sub-Customer A1.1]\n SUB_A1_2[Sub-Customer A1.2]\n end\n end\n \n subgraph \"Reseller B Customers\"\n CUST_B1[Customer B1
Child Organization]\n CUST_B2[Customer B2
Child Organization]\n end\n end\n \n subgraph \"Direct Customers\"\n DIRECT_CUST1[Direct Customer 1]\n DIRECT_CUST2[Direct Customer 2]\n end\n \n ROOT --> RESELLER_A\n ROOT --> RESELLER_B\n ROOT --> DIRECT_CUST1\n ROOT --> DIRECT_CUST2\n \n RESELLER_A --> CUST_A1\n RESELLER_A --> CUST_A2\n RESELLER_B --> CUST_B1\n RESELLER_B --> CUST_B2\n \n CUST_A1 --> SUB_A1_1\n CUST_A1 --> SUB_A1_2\n \n %% Data Isolation & Visibility\n RESELLER_A -.->|Can View| CUST_A1\n RESELLER_A -.->|Can View| CUST_A2\n CUST_A1 -.->|Can View| SUB_A1_1\n CUST_A1 -.->|Can View| SUB_A1_2\n \n RESELLER_B -.->|Can View| CUST_B1\n RESELLER_B -.->|Can View| CUST_B2\n \n CUST_A1 -.->|Cannot View| RESELLER_A\n SUB_A1_1 -.->|Cannot View| CUST_A1\n CUST_A1 -.->|Cannot View| CUST_A2\n CUST_B1 -.->|Cannot View| CUST_A1\n \n classDef root fill:#e8f5e8,stroke:#1b5e20\n classDef reseller fill:#e1f5fe,stroke:#01579b\n classDef customer fill:#f3e5f5,stroke:#4a148c\n classDef subcustomer fill:#fff3e0,stroke:#e65100\n classDef direct fill:#f1f8e9,stroke:#33691e\n classDef visibility fill:#0000ff,stroke-width:1px\n classDef no_visibility fill:#ff0000,stroke-width:1px,stroke-dasharray:5 5\n \n class ROOT root\n class RESELLER_A,RESELLER_B reseller\n class CUST_A1,CUST_A2,CUST_B1,CUST_B2 customer\n class SUB_A1_1,SUB_A1_2 subcustomer\n class DIRECT_CUST1,DIRECT_CUST2 direct" }), "\n", _jsxs(_components.h3, { id: "hierarchy-rules", children: [_jsx(_components.a, { className: "heading-link", href: "#hierarchy-rules", children: _jsx(_components.svg, { xmlns: "http:www.w3.org/2000/svg", fill: "#ab2b65", viewBox: "0 0 20 20", className: "w-5 h-5", children: _jsx(_components.path, { fillRule: "evenodd", clipRule: "evenodd", d: "M9.493 2.853a.75.75 0 00-1.486-.205L7.545 6H4.198a.75.75 0 000 1.5h3.14l-.69 5H3.302a.75.75 0 000 1.5h3.14l-.435 3.148a.75.75 0 001.486.205L7.955 14h2.986l-.434 3.148a.75.75 0 001.486.205L12.456 14h3.346a.75.75 0 000-1.5h-3.14l.69-5h3.346a.75.75 0 000-1.5h-3.14l.435-3.147a.75.75 0 00-1.486-.205L12.045 6H9.059l.434-3.147zM8.852 7.5l-.69 5h2.986l.69-5H8.852z" }) }) }), "Hierarchy Rules"] }), "\n", _jsx(_components.p, { children: _jsx(_components.strong, { children: "Visibility Patterns:" }) }), "\n", _jsxs(_components.ul, { children: ["\n", _jsxs(_components.li, { children: [_jsx(_components.strong, { children: "Parent → Child" }), ": Parents can view all data of their children"] }), "\n", _jsxs(_components.li, { children: [_jsx(_components.strong, { children: "Child → Parent" }), ": Children cannot view parent data"] }), "\n", _jsxs(_components.li, { children: [_jsx(_components.strong, { children: "Sibling → Sibling" }), ": Siblings cannot view each other's data"] }), "\n", _jsxs(_components.li, { children: [_jsx(_components.strong, { children: "Cross-Hierarchy" }), ": Organizations in different hierarchies cannot view each other"] }), "\n"] }), "\n", _jsx(_components.p, { children: _jsx(_components.strong, { children: "Data Isolation:" }) }), "\n", _jsxs(_components.ul, { children: ["\n", _jsx(_components.li, { children: "Complete data isolation between organizations at the same level" }), "\n", _jsx(_components.li, { children: "Hierarchical inheritance of visibility (downward only)" }), "\n", _jsx(_components.li, { children: "No upward or lateral visibility" }), "\n"] }), "\n", _jsx(_components.p, { children: _jsx(_components.strong, { children: "Reseller Model Support:" }) }), "\n", _jsxs(_components.ul, { children: ["\n", _jsx(_components.li, { children: "Resellers can have multiple customer organizations" }), "\n", _jsx(_components.li, { children: "Customers can have sub-customers (multi-level hierarchy)" }), "\n", _jsx(_components.li, { children: "Direct customers exist alongside reseller hierarchies" }), "\n"] }), "\n", _jsx(_components.hr, {}), "\n", _jsxs(_components.h2, { id: "4-security-boundaries--access-control", children: [_jsx(_components.a, { className: "heading-link", href: "#4-security-boundaries--access-control", children: _jsx(_components.svg, { xmlns: "http:www.w3.org/2000/svg", fill: "#ab2b65", viewBox: "0 0 20 20", className: "w-5 h-5", children: _jsx(_components.path, { fillRule: "evenodd", clipRule: "evenodd", d: "M9.493 2.853a.75.75 0 00-1.486-.205L7.545 6H4.198a.75.75 0 000 1.5h3.14l-.69 5H3.302a.75.75 0 000 1.5h3.14l-.435 3.148a.75.75 0 001.486.205L7.955 14h2.986l-.434 3.148a.75.75 0 001.486.205L12.456 14h3.346a.75.75 0 000-1.5h-3.14l.69-5h3.346a.75.75 0 000-1.5h-3.14l.435-3.147a.75.75 0 00-1.486-.205L12.045 6H9.059l.434-3.147zM8.852 7.5l-.69 5h2.986l.69-5H8.852z" }) }) }), "4. Security Boundaries & Access Control"] }), "\n", _jsx(_components.mermaid, { chart: "flowchart TD\n USER[User Attempts Access] --> AUTH{Authentication}\n \n AUTH -->|Invalid Credentials| DENY1[Access Denied]\n AUTH -->|Valid Credentials| ORG_CHECK{Organization Check}\n \n ORG_CHECK -->|Not Authorized for Org| DENY2[Access Denied]\n ORG_CHECK -->|Authorized for Org| ROLE_CHECK{Role Check}\n \n ROLE_CHECK -->|Role Not Permitted| DENY3[Access Denied]\n ROLE_CHECK -->|Role Permitted| RESOURCE_CHECK{Resource Type}\n \n RESOURCE_CHECK -->|Provider API Data| PROVIDER_ACCESS[Grant Provider API Access]\n RESOURCE_CHECK -->|SIM Bank Management| SIM_CHECK{SIM Bank Access}\n \n SIM_CHECK -->|Internal Staff Role| SIM_ACCESS[Grant SIM Bank Access]\n SIM_CHECK -->|External/Customer Role| DENY4[ACCESS DENIED
Security Boundary]\n \n PROVIDER_ACCESS --> AUDIT1[Log Access: Provider Data]\n SIM_ACCESS --> AUDIT2[Log Access: SIM Bank]\n DENY4 --> AUDIT3[Log Attempt: SIM Bank Violation]\n \n subgraph \"Critical Security Boundary\"\n SIM_BOUNDARY[SIM Bank Infrastructure
INTERNAL STAFF ONLY]\n end\n \n SIM_CHECK --> SIM_BOUNDARY\n \n classDef process fill:#e8f5e8,stroke:#1b5e20\n classDef check fill:#e1f5fe,stroke:#01579b\n classDef deny fill:#ffebee,stroke:#c62828\n classDef grant fill:#e8f5e8,stroke:#2e7d32\n classDef audit fill:#fff3e0,stroke:#e65100\n classDef boundary fill:#fce4ec,stroke:#880e4f,stroke-width:2px\n \n class USER,AUTH,ORG_CHECK,ROLE_CHECK,RESOURCE_CHECK,SIM_CHECK process\n class DENY1,DENY2,DENY3,DENY4 deny\n class PROVIDER_ACCESS,SIM_ACCESS grant\n class AUDIT1,AUDIT2,AUDIT3 audit\n class SIM_BOUNDARY boundary" }), "\n", _jsxs(_components.h3, { id: "security-boundary-details", children: [_jsx(_components.a, { className: "heading-link", href: "#security-boundary-details", children: _jsx(_components.svg, { xmlns: "http:www.w3.org/2000/svg", fill: "#ab2b65", viewBox: "0 0 20 20", className: "w-5 h-5", children: _jsx(_components.path, { fillRule: "evenodd", clipRule: "evenodd", d: "M9.493 2.853a.75.75 0 00-1.486-.205L7.545 6H4.198a.75.75 0 000 1.5h3.14l-.69 5H3.302a.75.75 0 000 1.5h3.14l-.435 3.148a.75.75 0 001.486.205L7.955 14h2.986l-.434 3.148a.75.75 0 001.486.205L12.456 14h3.346a.75.75 0 000-1.5h-3.14l.69-5h3.346a.75.75 0 000-1.5h-3.14l.435-3.147a.75.75 0 00-1.486-.205L12.045 6H9.059l.434-3.147zM8.852 7.5l-.69 5h2.986l.69-5H8.852z" }) }) }), "Security Boundary Details"] }), "\n", _jsx(_components.p, { children: _jsx(_components.strong, { children: "Critical Boundary - SIM Bank Management:" }) }), "\n", _jsxs(_components.ul, { children: ["\n", _jsxs(_components.li, { children: [_jsx(_components.strong, { children: "INTERNAL STAFF ONLY" }), ": Never exposed to customers"] }), "\n", _jsxs(_components.li, { children: [_jsx(_components.strong, { children: "Security Risk" }), ": \"SIM Banks can be dangerous\" - customer access poses significant security risks"] }), "\n", _jsxs(_components.li, { children: [_jsx(_components.strong, { children: "Access Pattern" }), ": Internal roles only (Admin, Support Staff with specific permissions)"] }), "\n", _jsxs(_components.li, { children: [_jsx(_components.strong, { children: "Audit Requirement" }), ": All SIM Bank access attempts are logged, including violations"] }), "\n"] }), "\n", _jsx(_components.p, { children: _jsx(_components.strong, { children: "Provider API Access Boundary:" }) }), "\n", _jsxs(_components.ul, { children: ["\n", _jsx(_components.li, { children: "Available to both internal staff and customers" }), "\n", _jsx(_components.li, { children: "Customers limited to their own organization's data" }), "\n", _jsx(_components.li, { children: "Filtered view of provider data based on organization hierarchy" }), "\n"] }), "\n", _jsx(_components.p, { children: _jsx(_components.strong, { children: "Authentication & Authorization Flow:" }) }), "\n", _jsxs(_components.ol, { children: ["\n", _jsxs(_components.li, { children: [_jsx(_components.strong, { children: "Authentication" }), ": Validate user credentials"] }), "\n", _jsxs(_components.li, { children: [_jsx(_components.strong, { children: "Organization Authorization" }), ": Verify user belongs to requested organization"] }), "\n", _jsxs(_components.li, { children: [_jsx(_components.strong, { children: "Role Permission Check" }), ": Validate role has required permissions"] }), "\n", _jsxs(_components.li, { children: [_jsx(_components.strong, { children: "Resource Type Check" }), ": Determine if accessing Provider API or SIM Bank"] }), "\n", _jsxs(_components.li, { children: [_jsx(_components.strong, { children: "Security Boundary Enforcement" }), ": Apply SIM Bank access restrictions"] }), "\n"] }), "\n", _jsx(_components.hr, {}), "\n", _jsxs(_components.h2, { id: "5-data-isolation--privacy", children: [_jsx(_components.a, { className: "heading-link", href: "#5-data-isolation--privacy", children: _jsx(_components.svg, { xmlns: "http:www.w3.org/2000/svg", fill: "#ab2b65", viewBox: "0 0 20 20", className: "w-5 h-5", children: _jsx(_components.path, { fillRule: "evenodd", clipRule: "evenodd", d: "M9.493 2.853a.75.75 0 00-1.486-.205L7.545 6H4.198a.75.75 0 000 1.5h3.14l-.69 5H3.302a.75.75 0 000 1.5h3.14l-.435 3.148a.75.75 0 001.486.205L7.955 14h2.986l-.434 3.148a.75.75 0 001.486.205L12.456 14h3.346a.75.75 0 000-1.5h-3.14l.69-5h3.346a.75.75 0 000-1.5h-3.14l.435-3.147a.75.75 0 00-1.486-.205L12.045 6H9.059l.434-3.147zM8.852 7.5l-.69 5h2.986l.69-5H8.852z" }) }) }), "5. Data Isolation & Privacy"] }), "\n", _jsxs(_components.h3, { id: "organization-data-isolation", children: [_jsx(_components.a, { className: "heading-link", href: "#organization-data-isolation", children: _jsx(_components.svg, { xmlns: "http:www.w3.org/2000/svg", fill: "#ab2b65", viewBox: "0 0 20 20", className: "w-5 h-5", children: _jsx(_components.path, { fillRule: "evenodd", clipRule: "evenodd", d: "M9.493 2.853a.75.75 0 00-1.486-.205L7.545 6H4.198a.75.75 0 000 1.5h3.14l-.69 5H3.302a.75.75 0 000 1.5h3.14l-.435 3.148a.75.75 0 001.486.205L7.955 14h2.986l-.434 3.148a.75.75 0 001.486.205L12.456 14h3.346a.75.75 0 000-1.5h-3.14l.69-5h3.346a.75.75 0 000-1.5h-3.14l.435-3.147a.75.75 0 00-1.486-.205L12.045 6H9.059l.434-3.147zM8.852 7.5l-.69 5h2.986l.69-5H8.852z" }) }) }), "Organization Data Isolation"] }), "\n", _jsxs(_components.ul, { children: ["\n", _jsxs(_components.li, { children: [_jsx(_components.strong, { children: "Database-level isolation" }), ": Organization ID on all records"] }), "\n", _jsxs(_components.li, { children: [_jsx(_components.strong, { children: "Query filtering" }), ": Automatic WHERE clause injection based on user's organization"] }), "\n", _jsxs(_components.li, { children: [_jsx(_components.strong, { children: "Hierarchical queries" }), ": Recursive queries for parent-child visibility"] }), "\n", _jsxs(_components.li, { children: [_jsx(_components.strong, { children: "Cross-organization protection" }), ": Prevent data leakage between organizations"] }), "\n"] }), "\n", _jsxs(_components.h3, { id: "customer-data-privacy", children: [_jsx(_components.a, { className: "heading-link", href: "#customer-data-privacy", children: _jsx(_components.svg, { xmlns: "http:www.w3.org/2000/svg", fill: "#ab2b65", viewBox: "0 0 20 20", className: "w-5 h-5", children: _jsx(_components.path, { fillRule: "evenodd", clipRule: "evenodd", d: "M9.493 2.853a.75.75 0 00-1.486-.205L7.545 6H4.198a.75.75 0 000 1.5h3.14l-.69 5H3.302a.75.75 0 000 1.5h3.14l-.435 3.148a.75.75 0 001.486.205L7.955 14h2.986l-.434 3.148a.75.75 0 001.486.205L12.456 14h3.346a.75.75 0 000-1.5h-3.14l.69-5h3.346a.75.75 0 000-1.5h-3.14l.435-3.147a.75.75 0 00-1.486-.205L12.045 6H9.059l.434-3.147zM8.852 7.5l-.69 5h2.986l.69-5H8.852z" }) }) }), "Customer Data Privacy"] }), "\n", _jsxs(_components.ul, { children: ["\n", _jsxs(_components.li, { children: [_jsx(_components.strong, { children: "GDPR Compliance" }), ": Data export and deletion capabilities"] }), "\n", _jsxs(_components.li, { children: [_jsx(_components.strong, { children: "Audit trails" }), ": All data access logged with user attribution"] }), "\n", _jsxs(_components.li, { children: [_jsx(_components.strong, { children: "Data retention" }), ": Configurable retention policies per data type"] }), "\n", _jsxs(_components.li, { children: [_jsx(_components.strong, { children: "Right to be forgotten" }), ": Complete customer data deletion capability"] }), "\n"] }), "\n", _jsxs(_components.h3, { id: "sim-bank-data-protection", children: [_jsx(_components.a, { className: "heading-link", href: "#sim-bank-data-protection", children: _jsx(_components.svg, { xmlns: "http:www.w3.org/2000/svg", fill: "#ab2b65", viewBox: "0 0 20 20", className: "w-5 h-5", children: _jsx(_components.path, { fillRule: "evenodd", clipRule: "evenodd", d: "M9.493 2.853a.75.75 0 00-1.486-.205L7.545 6H4.198a.75.75 0 000 1.5h3.14l-.69 5H3.302a.75.75 0 000 1.5h3.14l-.435 3.148a.75.75 0 001.486.205L7.955 14h2.986l-.434 3.148a.75.75 0 001.486.205L12.456 14h3.346a.75.75 0 000-1.5h-3.14l.69-5h3.346a.75.75 0 000-1.5h-3.14l.435-3.147a.75.75 0 00-1.486-.205L12.045 6H9.059l.434-3.147zM8.852 7.5l-.69 5h2.986l.69-5H8.852z" }) }) }), "SIM Bank Data Protection"] }), "\n", _jsxs(_components.ul, { children: ["\n", _jsxs(_components.li, { children: [_jsx(_components.strong, { children: "Physical infrastructure separation" }), ": SIM Bank data stored separately"] }), "\n", _jsxs(_components.li, { children: [_jsx(_components.strong, { children: "Access logging" }), ": Every SIM Bank operation logged with full audit trail"] }), "\n", _jsxs(_components.li, { children: [_jsx(_components.strong, { children: "Credential protection" }), ": Provider API credentials encrypted at rest"] }), "\n", _jsxs(_components.li, { children: [_jsx(_components.strong, { children: "No customer exposure" }), ": SIM Bank data never in customer-facing APIs or UI"] }), "\n"] }), "\n", _jsx(_components.hr, {}), "\n", _jsxs(_components.h2, { id: "6-audit--compliance", children: [_jsx(_components.a, { className: "heading-link", href: "#6-audit--compliance", children: _jsx(_components.svg, { xmlns: "http:www.w3.org/2000/svg", fill: "#ab2b65", viewBox: "0 0 20 20", className: "w-5 h-5", children: _jsx(_components.path, { fillRule: "evenodd", clipRule: "evenodd", d: "M9.493 2.853a.75.75 0 00-1.486-.205L7.545 6H4.198a.75.75 0 000 1.5h3.14l-.69 5H3.302a.75.75 0 000 1.5h3.14l-.435 3.148a.75.75 0 001.486.205L7.955 14h2.986l-.434 3.148a.75.75 0 001.486.205L12.456 14h3.346a.75.75 0 000-1.5h-3.14l.69-5h3.346a.75.75 0 000-1.5h-3.14l.435-3.147a.75.75 0 00-1.486-.205L12.045 6H9.059l.434-3.147zM8.852 7.5l-.69 5h2.986l.69-5H8.852z" }) }) }), "6. Audit & Compliance"] }), "\n", _jsxs(_components.h3, { id: "comprehensive-logging", children: [_jsx(_components.a, { className: "heading-link", href: "#comprehensive-logging", children: _jsx(_components.svg, { xmlns: "http:www.w3.org/2000/svg", fill: "#ab2b65", viewBox: "0 0 20 20", className: "w-5 h-5", children: _jsx(_components.path, { fillRule: "evenodd", clipRule: "evenodd", d: "M9.493 2.853a.75.75 0 00-1.486-.205L7.545 6H4.198a.75.75 0 000 1.5h3.14l-.69 5H3.302a.75.75 0 000 1.5h3.14l-.435 3.148a.75.75 0 001.486.205L7.955 14h2.986l-.434 3.148a.75.75 0 001.486.205L12.456 14h3.346a.75.75 0 000-1.5h-3.14l.69-5h3.346a.75.75 0 000-1.5h-3.14l.435-3.147a.75.75 0 00-1.486-.205L12.045 6H9.059l.434-3.147zM8.852 7.5l-.69 5h2.986l.69-5H8.852z" }) }) }), "Comprehensive Logging"] }), "\n", _jsxs(_components.ul, { children: ["\n", _jsxs(_components.li, { children: [_jsx(_components.strong, { children: "User authentication" }), ": All login attempts (success/failure)"] }), "\n", _jsxs(_components.li, { children: [_jsx(_components.strong, { children: "Data access" }), ": Every API call with organization and resource details"] }), "\n", _jsxs(_components.li, { children: [_jsx(_components.strong, { children: "Administrative actions" }), ": All system configuration changes"] }), "\n", _jsxs(_components.li, { children: [_jsx(_components.strong, { children: "Security violations" }), ": Attempted access to restricted resources (especially SIM Bank)"] }), "\n", _jsxs(_components.li, { children: [_jsx(_components.strong, { children: "Financial transactions" }), ": All wallet transactions and invoice operations"] }), "\n"] }), "\n", _jsxs(_components.h3, { id: "compliance-requirements", children: [_jsx(_components.a, { className: "heading-link", href: "#compliance-requirements", children: _jsx(_components.svg, { xmlns: "http:www.w3.org/2000/svg", fill: "#ab2b65", viewBox: "0 0 20 20", className: "w-5 h-5", children: _jsx(_components.path, { fillRule: "evenodd", clipRule: "evenodd", d: "M9.493 2.853a.75.75 0 00-1.486-.205L7.545 6H4.198a.75.75 0 000 1.5h3.14l-.69 5H3.302a.75.75 0 000 1.5h3.14l-.435 3.148a.75.75 0 001.486.205L7.955 14h2.986l-.434 3.148a.75.75 0 001.486.205L12.456 14h3.346a.75.75 0 000-1.5h-3.14l.69-5h3.346a.75.75 0 000-1.5h-3.14l.435-3.147a.75.75 0 00-1.486-.205L12.045 6H9.059l.434-3.147zM8.852 7.5l-.69 5h2.986l.69-5H8.852z" }) }) }), "Compliance Requirements"] }), "\n", _jsxs(_components.ul, { children: ["\n", _jsxs(_components.li, { children: [_jsx(_components.strong, { children: "Data retention" }), ": 7 years for financial records, 1+ years for audit logs"] }), "\n", _jsxs(_components.li, { children: [_jsx(_components.strong, { children: "GDPR compliance" }), ": User data export and deletion capabilities"] }), "\n", _jsxs(_components.li, { children: [_jsx(_components.strong, { children: "Security standards" }), ": TLS 1.3 encryption, secure credential storage"] }), "\n", _jsxs(_components.li, { children: [_jsx(_components.strong, { children: "Regular security reviews" }), ": Scheduled vulnerability assessments"] }), "\n"] }), "\n", _jsxs(_components.h3, { id: "monitoring--alerting", children: [_jsx(_components.a, { className: "heading-link", href: "#monitoring--alerting", children: _jsx(_components.svg, { xmlns: "http:www.w3.org/2000/svg", fill: "#ab2b65", viewBox: "0 0 20 20", className: "w-5 h-5", children: _jsx(_components.path, { fillRule: "evenodd", clipRule: "evenodd", d: "M9.493 2.853a.75.75 0 00-1.486-.205L7.545 6H4.198a.75.75 0 000 1.5h3.14l-.69 5H3.302a.75.75 0 000 1.5h3.14l-.435 3.148a.75.75 0 001.486.205L7.955 14h2.986l-.434 3.148a.75.75 0 001.486.205L12.456 14h3.346a.75.75 0 000-1.5h-3.14l.69-5h3.346a.75.75 0 000-1.5h-3.14l.435-3.147a.75.75 0 00-1.486-.205L12.045 6H9.059l.434-3.147zM8.852 7.5l-.69 5h2.986l.69-5H8.852z" }) }) }), "Monitoring & Alerting"] }), "\n", _jsxs(_components.ul, { children: ["\n", _jsxs(_components.li, { children: [_jsx(_components.strong, { children: "Real-time monitoring" }), ": Suspicious activity detection"] }), "\n", _jsxs(_components.li, { children: [_jsx(_components.strong, { children: "Alerting" }), ": Immediate notification for security boundary violations"] }), "\n", _jsxs(_components.li, { children: [_jsx(_components.strong, { children: "Reporting" }), ": Regular security reports for management review"] }), "\n", _jsxs(_components.li, { children: [_jsx(_components.strong, { children: "Incident response" }), ": Documented procedures for security incidents"] }), "\n"] }), "\n", _jsx(_components.hr, {}), "\n", _jsxs(_components.h2, { id: "7-implementation-considerations", children: [_jsx(_components.a, { className: "heading-link", href: "#7-implementation-considerations", children: _jsx(_components.svg, { xmlns: "http:www.w3.org/2000/svg", fill: "#ab2b65", viewBox: "0 0 20 20", className: "w-5 h-5", children: _jsx(_components.path, { fillRule: "evenodd", clipRule: "evenodd", d: "M9.493 2.853a.75.75 0 00-1.486-.205L7.545 6H4.198a.75.75 0 000 1.5h3.14l-.69 5H3.302a.75.75 0 000 1.5h3.14l-.435 3.148a.75.75 0 001.486.205L7.955 14h2.986l-.434 3.148a.75.75 0 001.486.205L12.456 14h3.346a.75.75 0 000-1.5h-3.14l.69-5h3.346a.75.75 0 000-1.5h-3.14l.435-3.147a.75.75 0 00-1.486-.205L12.045 6H9.059l.434-3.147zM8.852 7.5l-.69 5h2.986l.69-5H8.852z" }) }) }), "7. Implementation Considerations"] }), "\n", _jsxs(_components.h3, { id: "authentication-implementation", children: [_jsx(_components.a, { className: "heading-link", href: "#authentication-implementation", children: _jsx(_components.svg, { xmlns: "http:www.w3.org/2000/svg", fill: "#ab2b65", viewBox: "0 0 20 20", className: "w-5 h-5", children: _jsx(_components.path, { fillRule: "evenodd", clipRule: "evenodd", d: "M9.493 2.853a.75.75 0 00-1.486-.205L7.545 6H4.198a.75.75 0 000 1.5h3.14l-.69 5H3.302a.75.75 0 000 1.5h3.14l-.435 3.148a.75.75 0 001.486.205L7.955 14h2.986l-.434 3.148a.75.75 0 001.486.205L12.456 14h3.346a.75.75 0 000-1.5h-3.14l.69-5h3.346a.75.75 0 000-1.5h-3.14l.435-3.147a.75.75 0 00-1.486-.205L12.045 6H9.059l.434-3.147zM8.852 7.5l-.69 5h2.986l.69-5H8.852z" }) }) }), "Authentication Implementation"] }), "\n", _jsxs(_components.ul, { children: ["\n", _jsxs(_components.li, { children: [_jsx(_components.strong, { children: "Multi-factor authentication (MFA)" }), ": Support for all users"] }), "\n", _jsxs(_components.li, { children: [_jsx(_components.strong, { children: "Session management" }), ": Secure session handling with timeout policies"] }), "\n", _jsxs(_components.li, { children: [_jsx(_components.strong, { children: "Password policies" }), ": Strong password requirements and rotation"] }), "\n", _jsxs(_components.li, { children: [_jsx(_components.strong, { children: "API authentication" }), ": Token-based authentication for programmatic access"] }), "\n"] }), "\n", _jsxs(_components.h3, { id: "authorization-implementation", children: [_jsx(_components.a, { className: "heading-link", href: "#authorization-implementation", children: _jsx(_components.svg, { xmlns: "http:www.w3.org/2000/svg", fill: "#ab2b65", viewBox: "0 0 20 20", className: "w-5 h-5", children: _jsx(_components.path, { fillRule: "evenodd", clipRule: "evenodd", d: "M9.493 2.853a.75.75 0 00-1.486-.205L7.545 6H4.198a.75.75 0 000 1.5h3.14l-.69 5H3.302a.75.75 0 000 1.5h3.14l-.435 3.148a.75.75 0 001.486.205L7.955 14h2.986l-.434 3.148a.75.75 0 001.486.205L12.456 14h3.346a.75.75 0 000-1.5h-3.14l.69-5h3.346a.75.75 0 000-1.5h-3.14l.435-3.147a.75.75 0 00-1.486-.205L12.045 6H9.059l.434-3.147zM8.852 7.5l-.69 5h2.986l.69-5H8.852z" }) }) }), "Authorization Implementation"] }), "\n", _jsxs(_components.ul, { children: ["\n", _jsxs(_components.li, { children: [_jsx(_components.strong, { children: "RBAC framework" }), ": Flexible role and permission management"] }), "\n", _jsxs(_components.li, { children: [_jsx(_components.strong, { children: "Permission inheritance" }), ": Hierarchical permission inheritance"] }), "\n", _jsxs(_components.li, { children: [_jsx(_components.strong, { children: "Dynamic permission checks" }), ": Runtime authorization validation"] }), "\n", _jsxs(_components.li, { children: [_jsx(_components.strong, { children: "Permission caching" }), ": Optimized permission checking for performance"] }), "\n"] }), "\n", _jsxs(_components.h3, { id: "security-controls", children: [_jsx(_components.a, { className: "heading-link", href: "#security-controls", children: _jsx(_components.svg, { xmlns: "http:www.w3.org/2000/svg", fill: "#ab2b65", viewBox: "0 0 20 20", className: "w-5 h-5", children: _jsx(_components.path, { fillRule: "evenodd", clipRule: "evenodd", d: "M9.493 2.853a.75.75 0 00-1.486-.205L7.545 6H4.198a.75.75 0 000 1.5h3.14l-.69 5H3.302a.75.75 0 000 1.5h3.14l-.435 3.148a.75.75 0 001.486.205L7.955 14h2.986l-.434 3.148a.75.75 0 001.486.205L12.456 14h3.346a.75.75 0 000-1.5h-3.14l.69-5h3.346a.75.75 0 000-1.5h-3.14l.435-3.147a.75.75 0 00-1.486-.205L12.045 6H9.059l.434-3.147zM8.852 7.5l-.69 5h2.986l.69-5H8.852z" }) }) }), "Security Controls"] }), "\n", _jsxs(_components.ul, { children: ["\n", _jsxs(_components.li, { children: [_jsx(_components.strong, { children: "SQL injection protection" }), ": Prepared statements and ORM usage"] }), "\n", _jsxs(_components.li, { children: [_jsx(_components.strong, { children: "XSS protection" }), ": Input validation and output encoding"] }), "\n", _jsxs(_components.li, { children: [_jsx(_components.strong, { children: "CSRF protection" }), ": Token-based request validation"] }), "\n", _jsxs(_components.li, { children: [_jsx(_components.strong, { children: "Rate limiting" }), ": API rate limiting to prevent abuse"] }), "\n"] }), "\n", _jsx(_components.hr, {}), "\n", _jsxs(_components.h2, { id: "document-control", children: [_jsx(_components.a, { className: "heading-link", href: "#document-control", children: _jsx(_components.svg, { xmlns: "http:www.w3.org/2000/svg", fill: "#ab2b65", viewBox: "0 0 20 20", className: "w-5 h-5", children: _jsx(_components.path, { fillRule: "evenodd", clipRule: "evenodd", d: "M9.493 2.853a.75.75 0 00-1.486-.205L7.545 6H4.198a.75.75 0 000 1.5h3.14l-.69 5H3.302a.75.75 0 000 1.5h3.14l-.435 3.148a.75.75 0 001.486.205L7.955 14h2.986l-.434 3.148a.75.75 0 001.486.205L12.456 14h3.346a.75.75 0 000-1.5h-3.14l.69-5h3.346a.75.75 0 000-1.5h-3.14l.435-3.147a.75.75 0 00-1.486-.205L12.045 6H9.059l.434-3.147zM8.852 7.5l-.69 5h2.986l.69-5H8.852z" }) }) }), "Document Control"] }), "\n", _jsx(_components.div, { className: "overflow-x-auto", children: _jsxs(_components.table, { children: [_jsx(_components.thead, { children: _jsxs(_components.tr, { children: [_jsx(_components.th, { children: "Version" }), _jsx(_components.th, { children: "Date" }), _jsx(_components.th, { children: "Author" }), _jsx(_components.th, { children: "Changes" })] }) }), _jsx(_components.tbody, { children: _jsxs(_components.tr, { children: [_jsx(_components.td, { children: "1.0" }), _jsx(_components.td, { children: "2025-12-15" }), _jsx(_components.td, { children: "Nicko Goodwin" }), _jsx(_components.td, { children: "Initial draft" })] }) })] }) }), "\n", _jsxs(_components.p, { children: [_jsx(_components.strong, { children: "Next Review Date:" }), " January 15, 2026"] })] }); } function MDXContent(props = {}) { const {wrapper: MDXLayout} = { ..._provideComponents(), ...props.components }; return MDXLayout ? _jsx(MDXLayout, { ...props, children: _jsx(_createMdxContent, { ...props }) }) : _createMdxContent(props); } return { default: MDXContent };