> ## Documentation Index
> Fetch the complete documentation index at: https://aidocs.ethanbragdon.icu/llms.txt
> Use this file to discover all available pages before exploring further.
# Security & Audit Operations
> Investigate Starfire AI sessions, devices, access events, admin actions, API abuse, rate limits, risk signals, and audit history.
# Security & audit operations
Control Center security combines account/session visibility, platform events, developer abuse signals, and administrator audit history into an operational view.
## Security domains
The administration architecture includes concepts such as:
* sessions
* devices
* authentication events
* security holds
* API abuse
* IP/network activity metadata where appropriate
* rate-limit events
* administrator actions
* risk rules/signals
* audit history
## User security timeline
A user security timeline can connect events such as sign-in, session creation, device activity, developer-key creation, billing changes, or other security-relevant account events.
The purpose is correlation: operators can understand what happened around an incident without manually joining unrelated systems.
## Session controls
With the appropriate permission, an operator can revoke a session or broader account session set when responding to a lost device or suspected compromise.
Developer credentials are independent resources and should be reviewed separately when necessary.
## Security holds
A `SECURITY_HOLD`-style account state can restrict sensitive activity while an issue is investigated without implying that the account is permanently banned or deleted.
The hold should include a reason and administrative context where supported.
## Administrator actions
Audit history is especially important for actions such as:
* role and permission changes
* session revocation
* account restrictions
* credit adjustments
* billing changes
* model publishing
* platform configuration changes
* maintenance actions
Audit history should make the actor, target, action, and time clear.
## API abuse
Developer abuse signals can be handled through narrower controls such as quota changes, credential revocation, or developer-access restrictions instead of disabling unrelated user access automatically.
## Privacy boundary
Security operations require metadata, but the platform should avoid turning security tooling into unrestricted access to private conversations or files.
Security signals are evidence to investigate, not automatic proof of malicious intent. Use concrete event data and the platform's defined response controls rather than assumptions about a user.
Control which administrators can view or act on security information.
Review the broader Starfire security model.