Module 08 · Security & State
Enterprise posture, without the binder
Strict role scoping, encrypted state transitions, and an append-only ledger where every human action and agent decision is hash-chained and exportable as SOC 2 evidence.
Audit events (30d)
1.24M
0 gaps in chain
Access violations
0
least-privilege enforced
Encrypted fields
100%
PII + financial
Evidence packets
14 exported
SOC 2 Type II
Role-based access control
Seven roles, scoped by data boundary
| Role | Data scope | Permissions | Auth factor |
|---|---|---|---|
| Borrower | Own file only | Upload, e-sign, chat | Email OTP |
| Loan Officer | Assigned pipeline | Originate, lock, price | TOTP |
| Processor | Branch pipeline | Docs, conditions, orders | TOTP |
| Underwriter | Queue-assigned | Decision, conditions, AUS | TOTP + device |
| Closer | Closing queue | CD, docs, funding | TOTP + device |
| Admin | Tenant-wide | Config, roles, workflows | Hardware key |
| Executive | Read-only analytics | Dashboards, exports | TOTP |
Control health
Encryption at rest100%
AES-256 · per-tenant DEK, envelope wrapped
Key rotation100%
90-day automated rotation · last 26m ago
MFA enrollment100%
22/22 internal users · hardware key for admins
Tenant isolation tests96%
Row-level policies verified nightly
Immutable audit ledger
Append-only, hash-chained, agent decisions included
| Time | Actor | Event | Target | Chain hash |
|---|---|---|---|---|
| 12s ago | Guardrail Agent | TRID timer evaluated | NX-25107 | 0x9f2a…c41 |
| 1m ago | Doc Intelligence | Extracted 42 fields from 1040 | NX-25107 | 0x7bd1…9e0 |
| 4m ago | R. Vega (LO) | Rate lock 30d @ 6.125 | NX-25114 | 0x22ce…1a7 |
| 9m ago | Condition Agent | Clearance memo drafted PCC-04 | NX-25114 | 0x51aa…88b |
| 17m ago | M. Adeyemi (UW) | Condition UW-11 cleared | NX-25121 | 0xd004…f32 |
| 26m ago | System | Encryption key rotated (AES-256) | tenant:aurora | 0x8e77…4c9 |