A chokepoint for
sensitive ops —
human and agent,
with dual-control, hash-chained audit, and explainable anomaly detection. Proof over claims.
Chokepoint answers one question: how do you let people — and increasingly, AI agents — perform high-impact actions without giving anyone enough authority to abuse it? Role-based auth, working two-person approval, SHA-256 hash-chained HMAC-signed audit log, anomaly detection. No real tenant data. No hardcoded secrets. 26 tests that prove the security properties, not toy smoke tests.
Dual-control — Two-person rule
Irreversible actions need a second, distinct, authorized approver. Requester cannot approve own. 15min expiry. Break Glass excluded, monitored, alert on use.
Proof: authz.test.ts proves distinct-approver + authorized-approver
Tamper-evident ledger — Hash chain + HMAC
Every event SHA-256 hash-chained prevHash, HMAC-SHA256 signed with secret. Edit/delete/reorder/re-sign breaks chain and is provable. Merkle inclusion proofs.
Proof: ledger.test.ts detects altered, deleted, reordered, re-signed
Anomaly detection — Explainable
Failed logins, after-hours privilege, unknown sources, privilege escalation, automation, impossible travel surfaced with human-readable reasons. Risk index 0-100.
Proof: anomaly.test.ts signals fire on intended conditions
RBAC — Least privilege by default
Viewer / Operator / Auditor / Admin. Single policy gate on every action. Default-deny, explicit allow. Session TTL, CSRF, HttpOnly SameSite=Strict signed cookie.
Proof: authz.test.ts policy matrix + fail-closed
Policy simulator — Dry-run before prod
6 default tests dry-run clone policy. What If impact before approval. Report-Only first. Clone and test without touching prod ledger.
Proof: policySimulator.ts + /api/policy-simulate
SIEM export + Compliance mapper
Export JSON / CEF / OCSF / LEEF. Map to NIST, OWASP ASI03, SOC2, MITRE, ISO27001. Impersonation detector for agent_as_human, human_as_agent, role_spoof, session_hijack, token_replay.
Proof: siemExport.ts + complianceMapper.ts + impersonationDetector.ts
Tests that prove security properties — not toy smoke tests
Military-grade hardening — 10 upgrades
1. Encrypted sessions & audit: dual-control 4-eyes, hash-chained HMAC-SHA256 ledger, correlation ID tamper-evident
2. RBAC & least privilege: Viewer Operator Approver Admin, default-deny, separation of duties, TTL + CSRF
3. Break Glass: excluded from approval flows, monitored alert, password in vault, runbook tested quarterly
4. Tamper-evident ledger: SHA-256 chain + HMAC signed secret env, Merkle proofs, /api/audit/verify
5. Zero Trust: verify every request, device trust scoring, OWASP ASI03 mapped
6. Headers: nosniff, DENY, strict-origin, Permissions-Policy, CSP self-only, HSTS 63072000
7. No secrets: no hardcoded PATs, grep ghp_ clean, no real tenant, no tracking
Live Mandates — Dual-control queue
P1 • Critical • HMAC-signedEscalate operator to admin for incident response
Approver: Distinct required • Requester cannot approve own • 15min expiry
Wipe fleet of 50 devices — lost shipment
Approver: Admin + Auditor • Requester cannot approve own • 15min expiry
Grant agent billing write access to production
Approver: Admin only • Requester cannot approve own • 15min expiry
Disable DLP policy for external sharing
Approver: Auditor required • Requester cannot approve own • 15min expiry
Risk Engine — 0-100 behavioral scoring
Operator escalated 3 times in 24h, unusual velocity
Admin action at 02:14 UTC, outside 9-5 policy
5 failed logins from 192.168.1.45, possible brute force
Agent token used with human role — ASI03
riskEngine.ts • velocity + privilege creep + after-hours + failed auths + ASI03 + trust decay
Audit Ledger — Tamper-evident
✓ Chain intact • HMAC verified • Merkle inclusion proof valid • /api/audit/verify
Try tampering: edit one entry → chain breaks → provable. ledger.test.ts proves it.
Try it in 30 seconds — 4 demo accounts, no signup
Least-privilege: each role sees only what policy allows. Requester cannot approve own. Proof over claims.
admin
Approves critical, full policy control, Break Glass
Pass: admin1234
operator
Creates requests, runs scans, requests agent actions
Pass: operator1234
auditor
Verifies integrity, exports SIEM, compliance mapping
Pass: auditor1234
viewer
Read-only dashboard, risk index, anomaly feed
Pass: viewer1234