Operators sign in with Keycloak OIDC or a local account. A local account can require an authenticator-app code. Roles are admin, engineer, operator, auditor, and viewer. The auditor role is a read-only view of reports and the audit log.
01
Access layer
Identity & UIThe access layer is the console: identity, role, and the compliance workflow in one place.
One operator console. Sign-in is Keycloak OIDC or a local account with TOTP. Object ownership limits hosts, jobs, credentials, and reports.
Where it sits in the stack
- 01Access layer Focus
- 02 Control plane
- 03 Data and messaging
- 04 Execution layer
- 05 Managed targets
ReactKeycloakOIDCTOTPRBAC
How requests move
- 01
The operator opens the console
- 02
Keycloak or a local account verifies identity
- 03
Role and object owner limit what the session can open
- 04
The request goes to the control-plane API
What this layer does
-
Keycloak OIDC or a local account, with TOTP on local login
-
Roles from administrator to a read-only auditor
-
Object ownership on hosts, jobs, credentials, playbooks, and waivers
-
One console for discovery, checks, reports, and advisory AAG
Object ownership decides who can see and change a host, job, remediation, playbook, credential, waiver, or AuditFlow run. An administrator sees every object. Other roles see their own.
The same console holds Dashboard, AuditFlow, Audit Map, profiles, operations, reports, and AAG. AAG explains a finished check or builds a custom profile. It is not a control that starts a check or a remediation.