33 lines
43 KiB
HTML
33 lines
43 KiB
HTML
<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>SafetyNet · Management</title><link rel="stylesheet" href="/style.css"></head><body>
|
||
<a class="skip-link" href="#overview">Skip to workspace</a><aside aria-label="Management navigation"><div class="logo"><b>S</b><span>SafetyNet<small>Enterprise management</small></span></div><nav aria-label="Workspace"><span class="nav-group">WORKSPACE</span><a href="#overview">Overview</a><a href="#devices">Device fleet</a><a href="#events">Security events</a><a href="#incidents">Incident triage</a><span class="nav-group">POLICY & PROTECTION</span><a href="#policy">Browser policy</a><a href="#user-profiles">User classes & website access</a><a href="#policy-groups">Groups & pilot rollouts</a><a href="#policy-history">Policy history</a><a href="#policy-reviews">Independent approvals</a><a href="#managed-settings">User permissions</a><a href="#bookmarks">Company bookmarks</a><a href="#teaching">Data protection & AI</a><a href="#document-teaching">Document references</a><a href="#diagnostics-controls">Browser diagnostics</a><a href="#security-controls">Security rules & agents</a><a href="#visual-protection">Visual impersonation</a><a href="#clipboard-controls">Clipboard & ClickFix</a><a href="#password-vault">Password vault</a><span class="nav-group">DEPLOYMENT</span><a href="#enterprise-setup">Policy templates</a><a href="#enterprise-integrations">Network & scanners</a><a href="#access-sessions">Access & sessions</a></nav><div class="aside-note"><label for="console-theme">Console appearance</label><select id="console-theme"><option value="system">Use system theme</option><option value="light">Light</option><option value="dark">Dark</option></select><span class="pill">Development build · 0.1</span></div></aside><main><header><div><p class="eyebrow">SECURE ENTERPRISE BROWSING</p><h1>Management console</h1><p class="header-description">Policies, people and protection in one workspace.</p></div><div class="header-actions"><button id="refresh" class="secondary">Refresh workspace</button><button id="admin-logout" class="secondary" hidden>Sign out</button></div></header>
|
||
<section id="login" class="card"><h2>Administrator access</h2><p>Sign in with your enterprise identity, or use the bootstrap token configured on the server.</p><div class="row"><input id="token" type="password" placeholder="Bootstrap administrator token" autocomplete="off"><button id="connect">Connect</button><a class="button secondary" href="/auth/login" id="sso">Enterprise SSO</a></div></section>
|
||
<p id="status" role="status" aria-live="polite"></p><p id="siem-status" class="muted"></p>
|
||
<div id="workspace" hidden><div class="publish-bar" role="region" aria-label="Policy publication"><div><strong id="draft-state">Published policy loaded</strong><span id="draft-detail">Changes stay in your draft until publication.</span></div><div class="row"><button id="review-changes" class="secondary">Review draft changes</button><button id="publish-shortcut">Publish signed policy</button></div></div>
|
||
<section id="overview" class="metrics"><article><span>Enrolled devices</span><strong id="device-count">0</strong></article><article><span>Active policy</span><strong id="policy-version">v1</strong></article><article><span>Recent blocks</span><strong id="block-count">0</strong></article><article><span>AI workspace</span><strong id="ai-status">Off</strong></article></section><section class="overview-grid" aria-label="Current policy posture"><article class="card"><p class="eyebrow">POLICY POSTURE</p><h2>Current enforcement</h2><div id="policy-posture"></div><p class="muted">Based on the published policy. Configuration is not a device health attestation.</p></article><article class="card"><p class="eyebrow">OPERATOR WORKFLOW</p><h2>Configure, review, publish</h2><ol class="workflow"><li>Choose a template or adjust your controls.</li><li>Test data protection with representative examples.</li><li>Review changes and publish a signed policy.</li><li>Check device versions and security events.</li></ol><a href="#enterprise-setup" class="button secondary">Configure a policy template</a></article></section><section class="card" id="enterprise-setup"><p class="eyebrow">ENTERPRISE SETUP</p><h2>Start with a reviewed policy template</h2><p>Templates tighten selected controls while keeping your existing rules and infrastructure. Preview changes, add them to your draft, then publish when ready.</p><div class="row"><select id="preset-id"><option value="baseline">Enterprise baseline</option><option value="managed-ai">Managed AI workspace</option><option value="restricted">Restricted information</option><option value="existing-stack">Preserve existing security stack</option></select><button id="preset-preview" class="secondary">Preview template</button><button id="preset-apply" disabled>Add preview to draft</button></div><p id="preset-description"></p><div id="preset-changes"></div><h3>Integration configuration</h3><p>These checks describe policy configuration. They do not certify that an enrolled device can reach the service.</p><div id="integration-readiness"></div></section>
|
||
<section class="card" id="enterprise-integrations"><h2>Your existing network and security services</h2><p>Keep Windows-managed proxy and DNS for existing enterprise deployments, or mandate corporate resolvers and VPN interfaces. ICAP connects compatible antivirus and sandbox services before content is released.</p><div class="grid"><label>DNS mode<select id="enterprise-dns-mode"><option value="system">Windows / VPN DNS</option><option value="secure">Required corporate HTTPS DNS</option></select></label><label>Corporate HTTPS DNS resolvers <small>One HTTPS endpoint per line; clear when using Windows DNS</small><textarea id="enterprise-dns-templates" placeholder="https://dns.company.example/dns-query"></textarea></label><label class="checks"><input type="checkbox" id="enterprise-vpn-required"> Require corporate VPN interface</label><label>Approved Windows interface names <small>One exact adapter name per line</small><textarea id="enterprise-vpn-interfaces" placeholder="Company VPN"></textarea></label><label>Required VPN DNS server IPs <small>Optional; one IPv4 or IPv6 address per line</small><textarea id="enterprise-vpn-dns" placeholder="10.0.0.53"></textarea></label><label class="checks"><input type="checkbox" id="enterprise-icap-enabled"> Require external ICAP verdicts</label><button type="button" id="enterprise-icap-probe" class="secondary">Test ICAP capabilities</button><output id="enterprise-icap-status" aria-live="polite"></output><label>ICAP service URL<input id="enterprise-icap-url" placeholder="icaps://scanner.company.example:11344/avscan"></label><label>ICAP service method<select id="enterprise-icap-method"><option value="RESPMOD">Response modification service</option><option value="REQMOD">Request modification service</option></select></label><label>Inspection timeout (milliseconds)<input id="enterprise-icap-timeout" type="number" min="1000" max="60000"></label><label>Maximum inspection bytes<input id="enterprise-icap-max" type="number" min="1024" max="20971520"></label></div><div class="checks"><label><input type="checkbox" id="enterprise-icap-uploads"> Inspect uploads</label><label><input type="checkbox" id="enterprise-icap-downloads"> Inspect downloads</label><label><input type="checkbox" id="enterprise-icap-clipboard"> Inspect clipboard</label><label><input type="checkbox" id="enterprise-icap-ai"> Inspect AI requests</label><label><input type="checkbox" id="enterprise-icap-insecure"> Approve remote plaintext ICAP transport</label></div><p class="muted">TLS certificate validation stays enabled. Customer CA certificates and mutual TLS credentials belong in protected deployment configuration. Plaintext ICAP exposes submitted content; approve it only for a separately protected trusted transport. VPN adapter checks do not prove tunnel routing. Deferred verdicts and modified payloads are rejected. Publish the signed policy to apply changes.</p></section>
|
||
|
||
<section id="policy" class="card"><div class="section-head"><div><p class="eyebrow">CENTRAL CONFIGURATION</p><h2>One policy. Every managed browser.</h2></div><span class="pill" id="identity"></span></div>
|
||
<div class="grid"><label>Brand name<input id="brand-name" maxlength="40"></label><label>Brand accent<input id="brand-color" type="color"></label><label class="wide">Home URL<input id="home-url" type="url"></label><label>Allowed hosts <small>Empty allows all HTTP(S) destinations</small><textarea id="allowed-hosts" placeholder="example.com *.company.com"></textarea></label><label>Blocked hosts <small>One host per line</small><textarea id="blocked-hosts" placeholder="unapproved-ai.example"></textarea></label><label>Proxy mode<select id="proxy-mode"><option value="system">System proxy</option><option value="direct">Direct connection</option><option value="fixed_servers">Fixed proxy servers</option><option value="pac_script">HTTPS PAC script</option></select></label><label>Proxy rules / PAC URL<input id="proxy-value" placeholder="http=proxy.company.com:8080;https=proxy.company.com:8080"></label><label>Proxy bypass list<input id="proxy-bypass" placeholder="*.company.com"></label><label>Policy expiry<input id="expiry" type="datetime-local"></label><label>AI model<input id="ai-model" placeholder="Must match server-approved model"></label><label>Maximum inspected bytes<input id="max-bytes" type="number" min="1024" max="10485760"></label></div>
|
||
<div class="checks"><label><input id="downloads" type="checkbox"> Allow downloads</label><label><input id="devtools" type="checkbox"> Allow developer tools</label><label><input id="websockets" type="checkbox"> Allow WebSockets (messages not inspected)</label><label><input id="ai-enabled" type="checkbox"> Enable approved AI gateway</label></div><button id="publish">Publish signed policy</button><p class="muted">Devices refresh every 15 seconds. Changes and actor identity are recorded in the audit log.</p></section>
|
||
<section id="user-profiles" class="card"><p class="eyebrow">IDENTITY AND FEATURE ACCESS</p><h2>User classes and website access</h2><p>Create profiles for any user class with your own names and controls. Employee, developer and high-protection templates are optional starting points. Assign profiles to verified enterprise subjects or explicit managed devices. Asset-owner labels are not authenticated identities. Website denials and category restrictions accumulate across matching profiles; an allowlist does not bypass a denial.</p><button id="profiles-refresh" class="secondary">Refresh profiles</button><p id="profiles-status" role="status" aria-live="polite"></p><div class="table-wrap"><table><thead><tr><th>Profile</th><th>Assignments</th><th>Developer tools</th><th>Action</th></tr></thead><tbody id="profiles-rows"></tbody></table></div><div class="row"><button id="profile-new" class="secondary">Create your own profile</button><label>Starting class<select id="profile-template"><option value="employee">Employee</option><option value="developer">Developer</option><option value="high-protection">High protection</option></select></label><button id="profile-use-template" class="secondary">Use class in draft</button></div><h3 id="profile-editor-title">Create profile</h3><div class="grid"><label>Identifier<input id="profile-id" maxlength="80"></label><label>Name<input id="profile-name" maxlength="100"></label><label>Verified enterprise subject identifiers<textarea id="profile-subjects" placeholder="Exact issuer-verified subject; one per line"></textarea></label><fieldset><legend>Explicit device assignments</legend><div id="profile-devices" class="device-checklist"></div></fieldset><label>Allowed website hosts<textarea id="profile-allowed" placeholder="Empty adds no allowlist restriction"></textarea></label><label>Denied website hosts<textarea id="profile-blocked" placeholder="*.unapproved.example"></textarea></label><fieldset><legend>Denied domain categories</legend><div id="profile-categories" class="device-checklist"></div></fieldset><label>Developer tools / browser console<select id="profile-devtools"><option value="inherit">Inherit baseline</option><option value="deny">Deny</option><option value="allow">Allow within delegated baseline</option></select></label><label>Downloads<select id="profile-downloads"><option value="inherit">Inherit</option><option value="deny">Deny</option></select></label><label>AI workspace<select id="profile-ai"><option value="inherit">Inherit</option><option value="deny">Deny</option></select></label><label>Local agents<select id="profile-agents"><option value="inherit">Inherit</option><option value="deny">Deny</option></select></label><label class="checks"><input id="profile-scan" type="checkbox"> Require document analysis</label></div><p class="muted">Developer grants require central delegation; any applicable deny wins. No profile can override mandatory scanning or unlock centrally hidden settings.</p><div class="row"><button id="profile-save">Publish profile</button><button id="profile-delete" class="danger" disabled>Delete profile</button></div><h3>Preview effective device policy</h3><div class="row"><select id="profile-preview-device" aria-label="Preview device"></select><button id="profile-preview" class="secondary">Preview current draft</button></div><p id="profile-preview-summary" aria-live="polite"></p><div id="profile-preview-diff"></div><details><summary>Central categories and developer delegation</summary><p>Categories contain your approved domain lists. This is not an automatic external website reputation feed. Enabling delegation permits reviewed developer-profile grants; denying profiles still win.</p><label class="checks"><input id="profile-delegation" type="checkbox"> Permit profiles to grant developer tools</label><label>Category definitions JSON<textarea id="profile-category-json" rows="8" spellcheck="false" placeholder='[{"id":"social","name":"Social sites","hosts":["*.social.example"]}]'></textarea></label><button id="profile-config-save">Publish categories and delegation</button></details><h3>Assignment visibility</h3><div class="table-wrap"><table><thead><tr><th>Device</th><th>Verified subject</th><th>Effective profiles</th></tr></thead><tbody id="profile-device-rows"></tbody></table></div></section><section class="card" id="policy-groups"><p class="eyebrow">CONTROLLED DEPLOYMENT</p><h2>Groups and pilot rollouts</h2><p>Apply additional restrictions to explicit device groups. Start with selected pilot devices, inspect their reported policy versions, then explicitly expand the cohort. Group rules can tighten the baseline; they cannot weaken it. No automatic promotion occurs.</p><button id="groups-refresh" class="secondary">Refresh groups and reported versions</button><p id="groups-status" role="status" aria-live="polite"></p><div class="table-wrap"><table><thead><tr><th>Group</th><th>Members</th><th>Stage</th><th>Actions</th></tr></thead><tbody id="groups-rows"></tbody></table></div><h3 id="group-editor-title">Create a device group</h3><div class="grid"><label>Group identifier<input id="group-id" maxlength="80" placeholder="engineering"></label><label>Group name<input id="group-name" maxlength="100" placeholder="Engineering"></label><fieldset><legend>Group members</legend><div id="group-members" class="device-checklist"></div></fieldset><fieldset><legend>Rollout cohort</legend><label>Stage<select id="group-stage"><option value="pilot">Pilot devices</option><option value="expanded">Expanded cohort</option><option value="all">All group members</option></select></label><div id="group-cohort" class="device-checklist"></div><p class="muted">Pilot and expanded devices must belong to the group. All means all group members, not the entire fleet.</p></fieldset><label>Additional blocked hosts<textarea id="group-blocked-hosts" placeholder="unapproved-ai.example"></textarea></label><label>Additional blocked text phrases<textarea id="group-blocked-phrases"></textarea></label><fieldset><legend>Additional restrictions</legend><div class="checks"><label><input id="group-disable-downloads" type="checkbox"> Disable downloads</label><label><input id="group-disable-ai" type="checkbox"> Disable AI</label><label><input id="group-disable-agents" type="checkbox"> Disable local agents</label><label><input id="group-hide-settings" type="checkbox"> Hide settings</label><label><input id="group-require-scan" type="checkbox"> Require document inspection</label></div></fieldset><fieldset><legend>Settings section restrictions</legend><div id="group-sections"></div></fieldset></div><div class="row"><button id="group-new" class="secondary">Clear editor</button><button id="group-save">Publish group and rollout</button><button id="group-delete" class="danger" disabled>Remove selected group</button></div><p class="muted">Membership, restrictions and cohort changes are signed policy changes. Mandatory independent approval applies to these changes too.</p><h3>Additional company bookmarks</h3><p>These managed bookmarks are added for the selected rollout cohort. They do not replace baseline company bookmarks.</p><button id="group-bookmark-add" class="secondary">Add group bookmark</button><div class="table-wrap"><table><thead><tr><th>Title</th><th>URL</th><th>Folder</th><th>Action</th></tr></thead><tbody id="group-bookmark-rows"></tbody></table></div><h3>Effective policy preview</h3><div class="row"><select id="group-preview-device" aria-label="Device for effective policy preview"></select><button id="group-preview" class="secondary">Preview editor for device</button></div><p id="group-preview-summary"></p><div id="group-preview-diff"></div><h3>Reported rollout state</h3><div class="table-wrap"><table><thead><tr><th>Device</th><th>Effective groups</th><th>Reported / target version</th><th>Version acknowledgment</th><th>Last contact</th></tr></thead><tbody id="group-device-rows"></tbody></table></div><p class="muted">Acknowledgment compares the device-reported version with its target. It is not security attestation or proof that every control is functioning. Last contact is shown separately.</p></section><section class="card" id="policy-reviews"><p class="eyebrow">INDEPENDENT CHANGE CONTROL</p><h2>Policy approval queue</h2><p id="review-mode">Loading approval requirements.</p><p>Prepared changes remain inactive until approved. A different administrator must review the exact payload and base version. Stale changes must be prepared again against the latest policy.</p><button id="reviews-load" class="secondary">Refresh approval queue</button><p id="reviews-status" role="status" aria-live="polite"></p><div class="table-wrap"><table><thead><tr><th>Prepared</th><th>Author</th><th>Change</th><th>Base version</th><th>Status</th><th>Review</th></tr></thead><tbody id="reviews-rows"></tbody></table></div><div id="independent-review-detail" hidden><h3 id="independent-review-title"></h3><p id="independent-review-metadata"></p><p id="independent-review-operation" class="review-operation"></p><div id="independent-review-diff"></div><label class="checks"><input id="independent-review-confirm" type="checkbox"> I reviewed these exact changes and approve publishing them.</label><div class="row"><button id="independent-review-approve" disabled>Approve and publish signed policy</button><button id="independent-review-reject" class="danger" disabled>Reject proposed changes</button></div></div></section><section class="card" id="policy-history"><p class="eyebrow">CHANGE CONTROL</p><h2>Policy history and recovery</h2><p>Review persisted signed versions and compare changes. Restoring reapplies the selected security rules, permissions, bookmarks and network settings, group memberships and rollout cohorts. The original version stays preserved; restoration publishes a new version with a fresh expiry. Devices never receive a lower policy version.</p><div class="row"><button id="history-load" class="secondary">Load policy history</button><button id="history-more" class="secondary" hidden>Older versions</button></div><p id="history-status" role="status" aria-live="polite"></p><div class="table-wrap"><table><thead><tr><th>Version</th><th>Published</th><th>Actor</th><th>Review</th></tr></thead><tbody id="history-rows"></tbody></table></div><div id="history-review" hidden><h3 id="history-review-title"></h3><p id="history-review-summary"></p><div id="history-diff-list"></div><label class="checks"><input id="history-approve" type="checkbox"> I reviewed the previous security rules and settings and approve reapplying them as a new signed version.</label><button id="history-restore" class="danger" disabled>Restore as new signed version</button></div></section><section class="card" id="managed-settings"><h2>Managed browser settings</h2><button id="channel-key-download" class="secondary">Download public management signing key</button><p>Hide settings or deny changes centrally. These permissions are enforced in the native browser process as well as the interface. Hiding a section denies its user actions; publishing a new signed policy applies changes to connected devices at refresh.</p><label class="checks"><input id="settings-visible" type="checkbox"> Allow users to access the settings menu (approved work features remain available)</label><table><thead><tr><th>Section</th><th>Hide and deny access</th><th>Lock user actions</th></tr></thead><tbody><tr><td>Appearance</td><td><input id="settings-hide-appearance" type="checkbox" aria-label="Hide Appearance"></td><td><input id="settings-lock-appearance" type="checkbox" aria-label="Lock Appearance"></td></tr><tr><td>Bookmarks and tab groups</td><td><input id="settings-hide-library" type="checkbox" aria-label="Hide Bookmarks and tab groups"></td><td><input id="settings-lock-library" type="checkbox" aria-label="Lock Bookmarks and tab groups"></td></tr><tr><td>AI workspace</td><td><input id="settings-hide-ai" type="checkbox" aria-label="Hide AI workspace"></td><td><input id="settings-lock-ai" type="checkbox" aria-label="Lock AI workspace"></td></tr><tr><td>Password manager</td><td><input id="settings-hide-passwords" type="checkbox" aria-label="Hide Password manager"></td><td><input id="settings-lock-passwords" type="checkbox" aria-label="Lock Password manager"></td></tr><tr><td>Manual document scan</td><td><input id="settings-hide-documentScan" type="checkbox" aria-label="Hide Manual document scan"></td><td><input id="settings-lock-documentScan" type="checkbox" aria-label="Lock Manual document scan"></td></tr><tr><td>Local agent controls</td><td><input id="settings-hide-agents" type="checkbox" aria-label="Hide Local agent controls"></td><td><input id="settings-lock-agents" type="checkbox" aria-label="Lock Local agent controls"></td></tr></tbody></table><div class="grid"><label>Managed theme<select id="settings-theme"><option value="system">System</option><option value="light">Light</option><option value="dark">Dark</option></select></label><label>Managed accent<select id="settings-accent"><option value="blue">Blue</option><option value="teal">Teal</option><option value="violet">Violet</option></select></label><label>Managed tab layout<select id="settings-tabs"><option value="separate">Separate</option><option value="compact">Compact</option></select></label></div><p>Appearance values become mandatory when appearance is hidden, locked, or settings access is disabled. Otherwise users may choose local preferences. Vault locking remains available to keep credentials safe. Mandatory security inspection continues independently of settings visibility. Publish signed policy above to apply.</p></section>
|
||
<section class="card" id="bookmarks"><p class="eyebrow">COMPANY LIBRARY</p><h2>Managed bookmarks</h2><p>Publish intranet and approved service links to every browser. Company bookmarks are read-only for employees. Personal bookmarks remain separate; configure whether employees may add, edit or delete them.</p><div class="checks"><label><input type="checkbox" id="bookmarks-add"> Allow personal additions</label><label><input type="checkbox" id="bookmarks-edit"> Allow personal edits</label><label><input type="checkbox" id="bookmarks-delete"> Allow personal deletion</label><label><input type="checkbox" id="bookmarks-admin-read"> Allow administrators to read and edit personal bookmarks</label></div><div class="table-wrap"><table><thead><tr><th>Title</th><th>HTTPS / HTTP URL (no query or fragment)</th><th>Folder</th><th>Actions</th></tr></thead><tbody id="managed-bookmark-rows"></tbody></table></div><button class="secondary" id="managed-bookmark-add">Add company bookmark</button><p class="muted">Company changes are drafts until you publish the signed policy. Personal permissions also respect the centrally locked or hidden Library section.</p><h3>Device personal bookmarks</h3><p>Authorized administrators can review and remotely edit a device's synchronized personal bookmarks. Changes are applied when the browser next refreshes management state. Titles and URLs are never included in security audit events.</p><div class="row"><select id="bookmark-device" aria-label="Device to review"></select><button id="bookmark-device-load" class="secondary">Read device bookmarks</button></div><p id="bookmark-device-status" role="status" aria-live="polite"></p><div id="bookmark-device-editor" hidden><div class="table-wrap"><table><thead><tr><th>Title</th><th>HTTPS / HTTP URL (no query or fragment)</th><th>Folder</th><th>Actions</th></tr></thead><tbody id="personal-bookmark-rows"></tbody></table></div><div class="row"><button id="personal-bookmark-add" class="secondary">Add personal bookmark</button><button id="bookmark-device-save">Save remote changes</button><button id="bookmark-device-refresh" class="secondary">Discard edits and refresh</button></div><p class="muted">Saving compares the loaded revision so another user's or administrator's updates cannot be overwritten silently.</p></div></section>
|
||
<section id="teaching" class="card"><p class="eyebrow">TEACH YOUR BROWSER</p><h2>Define what must stay inside</h2><p>Add phrases that must never leave, or register an exact file fingerprint. Reference files stay on your computer; only their SHA-256 fingerprint enters policy.</p><div class="row"><input id="rule-label" placeholder="Rule name"><input id="rule-value" placeholder="Confidential phrase"><button id="add-rule">Add phrase</button></div><label class="file">Register a confidential file fingerprint<input id="fingerprint" type="file"></label><div id="rules"></div><div class="grid"><label class="wide">Try a policy example<textarea id="test-text" placeholder="Test content is sent to your management server, never to an AI provider."></textarea></label></div><button id="test" class="secondary">Test draft policy</button><output id="test-result"></output><h2>Local semantic reference protection</h2><p>Describe a confidential category. Your approved local EmbeddingGemma 2 runtime creates pinned text reference vectors. Document extraction and local OCR text can be compared against these references. This workflow does not train a model or provide native video inspection.</p><div class="grid"><label>Category name<input id="semantic-label" placeholder="Unreleased product designs"></label><label>Similarity threshold<input id="semantic-threshold" type="number" min="0.000001" max="1" step="0.01" value="0.8"></label><label class="wide">Confidential category description<textarea id="semantic-description" placeholder="Describe the protected topic with representative examples."></textarea></label></div><button id="semantic-add" class="secondary">Create semantic reference</button><label>Internal semantic reference document (up to 1 MiB)<input id="semantic-document" type="file"></label><button id="semantic-document-add" class="secondary">Derive local document reference</button><p>Only normalized reference vectors and coverage features enter the policy draft. No document, extracted text or model fine tuning is retained. Complete extraction and chunk coverage are required; publish explicitly to approve.</p><label class="checks"><input id="semantic-enabled" type="checkbox"> Enforce semantic categories</label><div id="semantic-rules"></div><p class="muted">Requires locally provisioned model weights, an exact model revision, matching dimensions and the document-v1 profile. Similarity is a detector score, not a confidence guarantee. Incomplete extraction or chunk coverage always blocks.</p></section>
|
||
<section class="card" id="security-controls"><h2>Enterprise security and local agents</h2><p>Configure centrally signed DNS blocklists, YARA source rules, content phrases, restricted Sigma metadata detections and agent permissions. Unsupported Sigma syntax is rejected.</p><div class="grid"><label class="checks"><input id="security-dns-enabled" type="checkbox"> Enforce DNS blocklists</label><label>Blocked DNS hosts<textarea id="security-dns-hosts" placeholder="*.unapproved.example"></textarea></label><label>Blocked IP addresses<textarea id="security-dns-ips" placeholder="203.0.113.10"></textarea></label><label>Blocked content phrases<textarea id="security-content-phrases" placeholder="One phrase per line"></textarea></label><label class="checks"><input id="security-yara-enabled" type="checkbox"> Require local YARA scanning</label><label>YARA maximum scanned bytes<input id="security-yara-max" type="number" min="1024" max="20971520"></label><label class="checks"><input id="agent-enabled" type="checkbox"> Enable paired local agents</label><label>Agent destination allowlist<textarea id="agent-hosts" placeholder="*.company.example"></textarea></label><label class="checks"><input id="agent-sensitive" type="checkbox"> Permit sensitive page reads within approved scopes</label><fieldset class="wide"><legend>Agent capabilities</legend><div class="checks"><label><input id="agent-scope-sessions" type="checkbox"> Sessions</label><label><input id="agent-scope-navigate" type="checkbox"> Navigate</label><label><input id="agent-scope-read" type="checkbox"> Read</label><label><input id="agent-scope-click" type="checkbox"> Click</label><label><input id="agent-scope-type" type="checkbox"> Type</label><label><input id="agent-scope-screenshot" type="checkbox"> Screenshot</label><label><input id="agent-scope-ai" type="checkbox"> AI gateway</label><label><input id="agent-scope-tabs:close" type="checkbox"> Close tabs</label><label><input id="agent-scope-bookmarks:list" type="checkbox"> Read bookmarks</label><label><input id="agent-scope-tabs:group" type="checkbox"> Group tabs</label><label><input id="agent-scope-tabs:activate" type="checkbox"> Activate tabs</label><label><input id="agent-scope-bookmarks:mutate" type="checkbox"> Organize user bookmarks</label><label><input id="agent-scope-application:state" type="checkbox"> Application state</label><label><input id="agent-scope-tabs:create" type="checkbox"> Create native tabs</label><label><input id="agent-scope-settings:get" type="checkbox"> Read managed settings</label><label><input id="agent-scope-settings:update" type="checkbox"> Change permitted appearance</label></div></fieldset><details class="wide"><summary>Advanced source configuration: YARA, Sigma and visual references</summary><p class="muted">Structured controls above are authoritative for DNS, content and agent permissions. Preserve advanced rule sources when making other changes.</p><label>Security policy JSON<textarea id="security-json" rows="14"></textarea></label><label>Local agent policy JSON<textarea id="agents-json" rows="6" readonly></textarea></label></details><label>AI provider<select id="ai-provider"><option value="openai-compatible">OpenAI compatible</option><option value="ollama">Local Ollama</option></select></label><label>AI trust mode<select id="ai-trust"><option value="external">Approved external provider</option><option value="local">Numeric loopback local model only</option></select></label><label class="checks"><input id="ai-confidential-local" type="checkbox"> Allow taught confidential text in approved local AI for all currently enrolled policy users. Credentials, unsafe content and uninspectable data remain blocked.</label><label>Approved endpoint identifier<input id="ai-endpoint"></label></div><p>Publish signed policy above to apply. Downloads require configured local YARA or external ICAP. Every enabled scanner is mandatory; unavailable inspection blocks downloads. Scan limit is 20 MB. Sigma supports exact metadata selection only.</p></section>
|
||
<section class="card" id="document-teaching"><h2>Governed document teaching</h2><p>Submit a reference document to the private local inspector, then explicitly approve its fingerprint for publication. For incomplete extraction, explicitly approve available fingerprints with partial coverage; unextracted media is not fingerprinted. Only hashes, coverage counts and the reference label are retained. Full documents, extracted text and base64 are discarded after local processing and are never persisted by management.</p><div class="row"><input id="teach-label" placeholder="Confidential reference label"><input id="teach-file" type="file"><button id="teach-submit">Create reviewed draft</button></div><div id="teach-drafts"></div></section><section class="card" id="password-vault"><h2>Local password vault</h2><p>Credentials stay on the browser device. Management stores permissions and lifecycle audit events only; passwords, usernames and credential identifiers are not uploaded.</p><div class="checks"><label><input id="vault-enabled" type="checkbox"> Enable password vault</label><label><input id="vault-saving" type="checkbox"> Allow saving credentials</label><label><input id="vault-autofill" type="checkbox"> Allow autofill</label></div><label>Idle lock in seconds (60–900)<input id="vault-idle" type="number" min="60" max="900"></label><p>Publish signed policy to apply these controls.</p></section><section class="card" id="visual-protection"><h2>Visual impersonation protection</h2><label class="checks"><input id="visual-enabled" type="checkbox"> Block protected login designs on unauthorized origins</label><p>For example, register a trusted Google login screenshot and allow only https://accounts.google.com. A matching login on another origin can then be blocked even when its domain is absent from every blocklist.</p><p>Upload your own trusted PNG of a brand login page or cropped login form. Only a derived perceptual hash, dimensions and allowed origins enter the policy draft. Reference pixels are discarded; no automatic Google or other brand profile is supplied.</p><div class="grid"><label>Brand identifier<input id="visual-id" maxlength="80" placeholder="corporate-login"></label><label>Brand label<input id="visual-label" maxlength="100" placeholder="Corporate login"></label><label class="wide">Exact allowed HTTPS origins<textarea id="visual-origins" placeholder="https://login.company.example"></textarea></label><label>Reference scope<select id="visual-scope"><option value="viewport">Whole viewport</option><option value="login-form">Cropped login form</option></select></label><label>Trusted PNG reference<input id="visual-image" type="file" accept="image/png"></label></div><button id="visual-add">Derive reference into draft</button><p>Add trusted references, enable the control above and publish the signed policy. Use multiple references for different themes, languages and login steps. False positives, viewport changes and visual evasion require validation. The browser checks rendered pixels; this is not pre-render response inspection.</p></section><section class="card" id="clipboard-controls"><h2>Managed clipboard and ClickFix protection</h2><p>Control supported browser copy, cut and paste actions centrally. High-risk shell command patterns are blocked without sending clipboard text to an AI provider. Clipboard text and credentials never enter security logs.</p><div class="checks"><label><input id="clipboard-enabled" type="checkbox"> Enable clipboard controls</label><label><input id="clipboard-copy" type="checkbox"> Allow copy</label><label><input id="clipboard-cut" type="checkbox"> Allow cut</label><label><input id="clipboard-paste" type="checkbox"> Allow paste</label><label><input id="clipboard-command" type="checkbox"> Block suspicious execution commands</label></div><label>Maximum clipboard text bytes<input id="clipboard-max" type="number" min="1024" max="1048576"></label><p>Publish signed policy to apply. Mandatory DLP remains active when supplemental clipboard controls are disabled. Unsupported formats and unavailable required inspection fail closed. Pattern detection covers selected execution chains; it does not prove text or commands safe.</p></section><section id="devices" class="card"><div class="section-head"><div><p class="eyebrow">DEVICE FLEET</p><h2>Enrollment and access</h2><p>Enable or disable supplemental manual document analysis per browser. Mandatory upload DLP and download YARA continue regardless of this setting.</p></div></div><div class="row"><input id="enroll-user" placeholder="Employee identity / asset owner"><button id="enroll">Create one-use enrollment code</button></div><output id="enrollment"></output><div class="row filter-row"><label>Find a device<input id="device-filter" type="search" placeholder="Name, identity or platform"></label><label>Access<select id="device-access-filter"><option value="all">All devices</option><option value="active">Active</option><option value="revoked">Revoked</option></select></label><output id="device-filter-count" aria-live="polite"></output></div><div class="table-wrap"><table><thead><tr><th>Device</th><th>Platform</th><th>Identity</th><th>Policy</th><th>Last seen</th><th>Access</th></tr></thead><tbody id="device-rows"></tbody></table></div></section>
|
||
<section id="access-sessions" class="card"><p class="eyebrow">ADMINISTRATOR ACCESS</p><h2>Active management sessions</h2><p>Administrators can review current SSO sessions and immediately revoke a session. Identity-provider group membership controls whether that person can sign in again. Bootstrap access has no stored browser session.</p><button id="sessions-load" class="secondary">Refresh active sessions</button><p id="sessions-status" role="status" aria-live="polite">Session inventory requires the administrator role.</p><div class="table-wrap"><table><thead><tr><th>Identity</th><th>Role</th><th>Expires</th><th>Action</th></tr></thead><tbody id="session-rows"></tbody></table></div></section><section id="incidents" class="card"><p class="eyebrow">SECURITY OPERATIONS</p><h2>Incident triage</h2><p>Review security event metadata, assign an investigation and record its outcome. Documents and prompts are not retained here. Keep investigation notes free of secrets and personal data.</p><div class="row filter-row"><label>Status<select id="incident-status-filter"><option value="">All statuses</option><option>open</option><option>investigating</option><option>resolved</option><option>dismissed</option></select></label><label>Severity<select id="incident-severity-filter"><option value="">All severities</option><option>low</option><option>medium</option><option>high</option><option>critical</option></select></label><button id="incidents-refresh" class="secondary">Refresh incidents</button></div><p id="incidents-status" role="status" aria-live="polite"></p><div class="table-wrap"><table><thead><tr><th>Created</th><th>Security event</th><th>Status</th><th>Severity</th><th>Assignee</th><th>Review</th></tr></thead><tbody id="incident-rows"></tbody></table></div><button id="incidents-more" class="secondary" hidden>Load older incidents</button><div id="incident-detail" hidden><div class="section-head"><h3 id="incident-title">Incident</h3><button id="incident-detail-refresh" class="secondary">Discard edits and refresh</button></div><p id="incident-revision" class="muted"></p><pre id="incident-event"></pre><div class="grid"><label>Investigation status<select id="incident-state"><option>open</option><option>investigating</option><option>resolved</option><option>dismissed</option></select></label><label>Severity<select id="incident-severity"><option>low</option><option>medium</option><option>high</option><option>critical</option></select></label><label>Assignee<input id="incident-assignee" maxlength="160" placeholder="Team or analyst identity"></label><label class="wide">Investigation note<textarea id="incident-comment" maxlength="1000" placeholder="Metadata and investigation outcome only; do not paste secrets."></textarea></label></div><button id="incident-save">Save investigation update</button><p id="incident-detail-status" role="status" aria-live="polite"></p><h3>Investigation history</h3><div id="incident-history"></div></div></section><section class="card" id="audit-retention"><p class="eyebrow">AUDIT LIFECYCLE</p><h2>Database event retention</h2><p id="audit-retention-status" role="status">Loading deployment configuration.</p><p class="muted">Retention applies only to exported database events that are not referenced by incidents. Investigation history is retained. External SIEM, file exports and backups have separate retention policies. Deployment configuration controls this setting.</p></section><section id="events" class="card"><p class="eyebrow">SECURITY MONITORING</p><h2>Recent audit events</h2><div class="row"><button id="export-ecs" class="secondary">Export ECS JSON</button><button id="export-cef" class="secondary">Export CEF</button></div><div class="row filter-row"><label>Find an event<input id="event-filter" type="search" placeholder="Event type, device or metadata"></label><label>Decision<select id="event-decision-filter"><option value="all">All events</option><option value="block">Blocks</option><option value="allow">Allows</option></select></label><output id="event-filter-count" aria-live="polite"></output></div><div class="table-wrap"><table><thead><tr><th>Time</th><th>Event</th><th>Device</th><th>Metadata</th></tr></thead><tbody id="event-rows"></tbody></table></div><p class="muted">This view shows the latest 100 events. Prompts and document contents are excluded. Exports contain up to 1,000 events; cursor-based APIs and durable HTTPS delivery support continuous SIEM ingestion.</p></section>
|
||
<section id="diagnostics-controls" class="card"><p class="eyebrow">OBSERVABILITY</p><h2>Browser OpenTelemetry</h2><p>Publish centrally signed operational or detailed debug collection. Spans report code stages, timing and outcomes. Confidential security evidence needs its separate protected storage; passwords and authentication tokens are excluded.</p><div class="grid"><label><input id="diagnostics-enabled" type="checkbox"> Enable browser diagnostics</label><label>Mode<select id="diagnostics-mode"><option value="operational">Operational</option><option value="debug">Detailed debug</option></select></label><label class="wide">Collector endpoint<input id="diagnostics-endpoint" type="url" placeholder="https://collector.company.example"></label><label>Operational sampling<input id="diagnostics-sample" type="number" min="0" max="1" step="0.01"></label><label>Debug sampling<input id="diagnostics-debug-sample" type="number" min="0" max="1" step="0.01"></label></div><p>HTTPS is required except for a numeric loopback collector. Queue and export limits remain enforced. Endpoint credentials do not belong in policy URLs. Disable and publish to stop new collection.</p></section></div></main><dialog id="change-review" aria-labelledby="change-review-title"><div class="section-head"><h2 id="change-review-title">Review policy changes</h2><button id="review-close" class="secondary">Close</button></div><p>Review the changed policy paths before publication. Existing server validation and version checks remain authoritative.</p><div id="change-review-list"></div><p id="change-review-summary" class="muted"></p></dialog><script src="/admin.js"></script><script src="/group-admin.js"></script><script src="/profile-admin.js"></script><script src="/incident-admin.js"></script><script src="/diagnostics-admin.js"></script></body></html>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|