13 lines
2.9 KiB
Markdown
13 lines
2.9 KiB
Markdown
|
# Centrally managed user profiles
|
||
|
|
|
||
|
|
Administrators can create arbitrary named profiles; employee, developer and executive are examples, not fixed roles. Profiles can target explicit device IDs or verified OIDC subject IDs. A subject applies to all devices enrolled through verified SSO for that subject. Provisioning-code labels and user-supplied enrollment fields never become verified identities. Existing provisioning-code devices can be assigned explicitly by an administrator.
|
||
|
|
|
||
|
|
The policy publisher reviews profile CRUD, category edits and delegation changes through the same independent-review flow as other policy changes. Successful publication advances the shared signed generation. Each device receives only effective policy and assigned profile IDs, not the profile's subject lists. Profile/category snapshots accompany every policy generation; history restoration restores them at a new generation. Historical snapshots missing profile configuration cannot silently restore current profile assignments.
|
||
|
|
|
||
|
|
Host denials and administrator-maintained domain categories combine with union. Nonempty profile allowlists intersect with the company allowlist and other matching profiles. A disjoint intersection denies every host; it never becomes unrestricted. Category matching uses the same exact/wildcard host enforcement as normal browser navigation; categories are curated host lists, not a commercial classification feed. Existing device-group restrictions apply after user profiles.
|
||
|
|
|
||
|
|
Features currently support DevTools inherit/allow/deny; downloads, AI and agents inherit/deny; and mandatory local document scanning. DevTools allow requires the signed company `userAccess.delegatableFeatures.devTools` ceiling. Conflicting profile denies win regardless of ordering. Administrators can leave the ceiling off to prohibit delegation globally. These profiles do not disable mandatory DLP, signatures, sandboxing or parser isolation.
|
||
|
|
|
||
|
|
API: `GET /api/admin/user-profiles`, `PUT/DELETE /api/admin/user-profiles/:id`, `POST /api/admin/user-profiles/preview`, and `PUT /api/admin/user-profile-configuration`. Mutations use `expectedVersion`; mandatory review returns 202 with the existing review ID/hash. Preview and read require policy.read; writes require policy.write, or policy.prepare when independent approval is mandatory. The configuration endpoint replaces categories and sets the DevTools delegation ceiling. It does not replace profile assignments.
|
||
|
|
|
||
|
|
Verified automated evidence: `tests/user-profiles.test.mjs` covers same verified subject on two devices, different subjects, false user labels, explicit delegation, deny precedence, category blocking, allowlist intersection, independent review, stale publication, auditor denial and historical restore. The admin Electron smoke independently exercises custom profile creation and review. SCIM, automatic identity-group synchronization, profile-specific proxy overrides and additional feature flags remain future work.
|