Skip to main content

​
Security & audit operations

Control Center security combines account/session visibility, platform events, developer abuse signals, and administrator audit history into an operational view.

​
Security domains

The administration architecture includes concepts such as:
  • sessions
  • devices
  • authentication events
  • security holds
  • API abuse
  • IP/network activity metadata where appropriate
  • rate-limit events
  • administrator actions
  • risk rules/signals
  • audit history

​
User security timeline

A user security timeline can connect events such as sign-in, session creation, device activity, developer-key creation, billing changes, or other security-relevant account events. The purpose is correlation: operators can understand what happened around an incident without manually joining unrelated systems.

​
Session controls

With the appropriate permission, an operator can revoke a session or broader account session set when responding to a lost device or suspected compromise. Developer credentials are independent resources and should be reviewed separately when necessary.

​
Security holds

A SECURITY_HOLD-style account state can restrict sensitive activity while an issue is investigated without implying that the account is permanently banned or deleted. The hold should include a reason and administrative context where supported.

​
Administrator actions

Audit history is especially important for actions such as:
  • role and permission changes
  • session revocation
  • account restrictions
  • credit adjustments
  • billing changes
  • model publishing
  • platform configuration changes
  • maintenance actions
Audit history should make the actor, target, action, and time clear.

​
API abuse

Developer abuse signals can be handled through narrower controls such as quota changes, credential revocation, or developer-access restrictions instead of disabling unrelated user access automatically.

​
Privacy boundary

Security operations require metadata, but the platform should avoid turning security tooling into unrestricted access to private conversations or files.
Security signals are evidence to investigate, not automatic proof of malicious intent. Use concrete event data and the platform’s defined response controls rather than assumptions about a user.

RBAC & Support Mode

Control which administrators can view or act on security information.

Security overview

Review the broader Starfire security model.