# Protected incident evidence

The incident console lists linked evidence metadata without decrypting content.
Administrators and the dedicated analyst role can choose incident-response,
investigation or compliance as an access purpose and explicitly reveal a record.
`OIDC_ANALYST_GROUP` grants evidence read and incident triage without policy, device,
SIEM or session administration. It remains a server-defined role, not a permission
supplied by the browser. Operator membership takes precedence over analyst when
both are configured; administrators retain full access.

Plaintext uses textContent, never HTML, and is cleared after one minute, selection
changes, refresh, permission/identity changes, logout and page hiding. Delayed
responses cannot restore older content. Reveals are restricted to the available
records shown for the selected incident and checked against source-event identity.
Every successful plaintext response follows a durable purpose-bound access audit.

Evidence is device-reported information, not an independent truth attestation.
Incoming action, decision, host, file digest/size and supplied content digest are
compared with available source facts. Legacy events without those facts cannot
supply the same verification. Encryption authenticates the evidence row; a fully
tamper-evident source audit chain remains a separate production requirement.

Configure the external 32-byte `EVIDENCE_KEY_FILE` before enabling storage. On
Windows, startup verifies owner and read/write ACLs and rejects shared key access;
protect the file to the service identity, SYSTEM and Administrators. POSIX requires
an owner-only file. No key is exposed through the console. Key rotation, external
KMS/HSM custody and production backup/recovery remain deployment work.

Tests exercise actual encrypted storage, RBAC, audit failure, mismatched facts,
expiry/active incident hold and integrity failure. The genuine Electron console
proof covers purpose-bound reveal, literal script text and clearing, while backend
OpenTelemetry exports normalized metadata/discovery/reveal route timings.

Automatic native browser capture and centrally signed collection rules remain
open. This viewer completes the existing protected storage/API-to-analyst path;
it does not yet collect every click or confidential clipboard fragment itself.