36 lines
2.2 KiB
Markdown
36 lines
2.2 KiB
Markdown
|
# Protected interaction evidence
|
||
|
|
|
||
|
|
Administrators separately enable `evidence.enabled`, `captureDownloads` and
|
||
|
|
`captureInteractions` through reviewed signed policy. All are off by default.
|
||
|
|
Interaction capture currently covers confirmed guarded copy/cut/paste and
|
||
|
|
completed agent clicks. It is not a recording of every physical user click.
|
||
|
|
|
||
|
|
Ordinary clipboard audit distinguishes authorization before the effect from
|
||
|
|
completion after the effect. Protected completion metadata contains website
|
||
|
|
origin, opaque session ID, action, structural target tag/role, bounded viewport
|
||
|
|
coordinates and optional byte count. Paths, queries, fragments, field values,
|
||
|
|
document text, selectors, labels and content hashes are excluded. Sensitive
|
||
|
|
fields do not produce this capture.
|
||
|
|
|
||
|
|
Agent completion capture is a separate audit phase from RPC completion; two
|
||
|
|
events do not mean two clicks. The native fixture verifies one click effect.
|
||
|
|
The server binds evidence to the accepted device event, action, source, session
|
||
|
|
and completed outcome. New writes reject raw interaction content. Existing
|
||
|
|
encrypted legacy evidence remains readable through restricted audited access.
|
||
|
|
|
||
|
|
The source event and typed protected payload are persisted in one DPAPI-protected
|
||
|
|
local queue record. Delivery acknowledges the ordinary event first and uses the
|
||
|
|
protected post-quantum management evidence channel. Policy and enrollment are
|
||
|
|
rechecked throughout delivery. Disabling interaction capture aborts matching
|
||
|
|
in-flight delivery and removes pending interaction evidence while preserving
|
||
|
|
ordinary audit and separately allowed download evidence. Existing retained
|
||
|
|
records still follow retention, legal-hold and purpose-bound analyst access.
|
||
|
|
|
||
|
|
Debug traces measure capture, challenge, encryption, send and acknowledgement,
|
||
|
|
with correlated server decrypt/store phases. These timing spans carry no raw
|
||
|
|
interaction contents. Evidence retention is independent of diagnostics.
|
||
|
|
|
||
|
|
Remaining coverage includes general physical interaction observation, controlled
|
||
|
|
content capture, all browser convenience clipboard paths and a proven scoped
|
||
|
|
credential-submission exception. Do not assume this feature is full page replay
|
||
|
|
or blanket password-field authorization.
|