Frozen document. Dates and status refer to its original source. Private resources and unreviewed images are unavailable.

Identity, document, and audit contract

Status: accepted, with browser-token mechanics superseded by ADR 0009 on September 23, 2026. The owner accepted the remaining security defaults on September 22, 2026. The authoritative resolution lives in Decide identity, MFA, sensitive documents, and audit controls.

This contract applies the accepted roles, record ownership, bilingual forms, workflow, and API contract. ADR 0009 records the current browser identity architecture. These are prototype controls without a production or regulatory compliance claim. Supporting capabilities and limits are recorded in Security controls feasibility.

Identity and browser sessions

[Private setup detail omitted.]

Seed synthetic users and business relationships. Disable public self-registration, social login, and employer federation in the first demo. One application login supports the accepted personal and employer contexts. Keep realm administration separate from portal business roles. Contentful and other platform consoles may use their own identities; do not assume SaaS SSO or account entitlements. Portal release actions still require the content-author permission, and authors preview only synthetic data.

Require password plus TOTP for all interactive Atlas business roles. Guide enrollment through Keycloak; never store OTP seeds or codes in Atlas. Do not add an MFA bypass for demonstrations. Service identities use their own scoped credentials and no interactive user MFA flow.

Accepted session defaults: five-minute access tokens, 15-minute SSO idle timeout, eight-hour absolute SSO lifetime, and no offline tokens or remember-me extension. Refresh failure invalidates the BFF session, stops authenticated calls and requests sign-in. Explicit logout destroys the server session, clears the browser cookie and private browser state, and ends the Keycloak session. Cross-tab logout clears other tabs where possible. Existing access-token revocation may otherwise be bounded by expiry; never promise instant revocation from a local JWT check alone. Sensitive actions must also verify current account/session eligibility, failing closed when that check is unavailable.

For adding/replacing a synthetic payment account, authorizing a premium collection or annuity withdrawal, and recording a reviewer approval that authorizes a payout, require verified higher assurance with MFA freshness within five minutes. That window may cover several authorized actions; this does not require a new OTP for every transaction. API checks must use trustworthy assurance and authentication-time evidence, not token issue/refresh time or a browser flag. Configure and test the selected Keycloak flow and claims before the sensitive-action slice is ready. A stale or missing assurance result sends the user through step-up while preserving the saved draft and intended action; the user then confirms the action. Existing API idempotency and revision rules still apply.

Use controlled recovery for seeded accounts. Defer self-service password-reset email, SMS MFA, recovery-code login, and a portal support-reset UI. A separately authorized realm administrator can reset a synthetic account through a documented runbook, record the reset event, revoke existing sessions, and require password change/TOTP re-enrollment before resumed business access. Portal technical operators do not acquire realm-admin powers. No recovery event itself counts as successful MFA.

Authorization and service access

Verify issuer, audience, signature, expiry, and permitted client/scopes at API entry. Record owners recheck current ownership, employer membership/reporting relationship, case assignment, allowed action, and revision. User-selected context and linked record IDs are inputs to authorization, not evidence of permission. Minimize token claims and retain sensitive business relationships in their authoritative modules.

Apply field allowlists to responses. Managers receive leave dates, proposed/approved return dates, leave/RTW status and whether the next manager action is available. They receive no diagnosis, treatment, evidence contents, clinical notes, claim outcome, EOI, or banking data. Related disability cases do not expand this view. Reviewers see only their assigned cases and required evidence. Employer administrators retain membership/enrollment access without medical or banking fields. Exact nonmedical fields for each action belong in the later schemas.

Check Camunda task state/assignment and current business eligibility before accepting a task action, as already agreed. Browser buttons, broad realm roles, cached views, or a process key cannot authorize it. Return not-found for authenticated cross-owner/cross-employer record lookups to avoid confirming a hidden record exists; use forbidden for a disallowed action on an otherwise visible record. Errors remain bilingual and do not reveal private identifiers or diagnostics.

Give each service/worker a separate credential with minimum required audiences and actions. Strip untrusted identity headers and propagate actor context only over authenticated service calls. Keep service and OIDC client secrets out of SPA builds, Git, Contentful content, workflow variables, and logs. Use local secret injection for Docker and protected environment configuration for hosted runtimes. TLS is required across browser and cross-host connections. Runtime topology must explicitly document any isolated container-network exception and storage protection; none is assumed here.

Documents and synthetic payment details

Accept PDF, JPEG, and PNG evidence, maximum 10 MiB per file and 20 files per case. Verify extension, detected type/signature, size, and upload authorization; reject encrypted/password-protected PDFs and unsupported content that cannot be inspected. Generate storage keys rather than using filenames as paths.

Register uploads against an authorized case/document purpose and keep bytes in private quarantine until a real malware scanner accepts them. Select the scanner/runtime in the topology decision. Pending, rejected, failed-scan, and timed-out uploads cannot be downloaded or satisfy evidence gates. No publicly readable bucket or Contentful evidence assets. Simulator fixtures may demonstrate infected/rejected outcomes, but a simulated result must not be presented as a real scan.

Require authorization again when downloading and stream approved content through a protected endpoint as an attachment for the first demo. Defer public or reusable presigned download links and inline document previews. Registry links, versions, and review status preserve which evidence was reviewed; replacing a file creates a new version rather than overwriting submitted evidence.

Customers may remove their own unattached draft uploads. Submitted or reviewed evidence remains in the case history until the demo dataset reset. Clean up abandoned incomplete uploads after 24 hours. Retain synthetic cases, decisions, operations, deduplication records, completed evidence versions and audit records until an explicit documented demo reset. Do not silently expire deduplication evidence while effects remain replayable. A reset must stop processing and invalidate old sessions/operation namespaces before replacing the synthetic dataset; it is a later operator runbook, not an action authorized by this decision. Production retention, deletion rights and legal holds remain outside this prototype decision.

Use synthetic account aliases/masked display values and simulator references only. Do not ask for real routing/account numbers. A payment instruction captures its authorized account reference; subsequent profile changes affect future instructions only. EOI acknowledgments record actor, time, form release, locale and acknowledged declaration. Third-party digital-signature integration and claims of legally sufficient e-signature are deferred.

Audit, accessible authentication, and validation

Record structured submission, decision, authorization-denial, authentication/recovery, document-access, account-change, release-publication, cancellation and technical-recovery events. Include UTC time, actor/service identity, business context, action, target reference, outcome, correlation/operation ID, relevant version/revision, and locale. Link Keycloak security events and business audit events through an explicit correlation design where available; do not claim every platform provides a shared trace automatically.

Application audit interfaces are append-only with restricted read access. Operator diagnostics are redacted and grant no business edit capability. Separate host/realm administration from normal portal operation; local host access is outside application RBAC and cannot be described as tamper-proof. Keep raw form answers, medical details, document bytes/names, bank fields, passwords, tokens, OTP secrets/codes and credentials out of diagnostic/audit payloads. Store customer-facing decision reasons in the authorized business record, not unrestricted logs.

Carry en-US/es-US into login, enrollment, MFA, step-up, errors, logout and session-expiry experiences. Inspect the pinned Keycloak theme and provide explicit locale mapping or regional bundles; stock Spanish availability alone does not prove es-US copy completeness. Use keyboard-operable flows, visible focus, labels, announced errors, accessible OTP text entry, and password-manager/paste support. Show session-expiry warnings where possible and preserve only already saved drafts on the server. Do not cache private API responses, answers or tokens in a service worker or persistent browser storage.

Later evidence must cover wrong issuer/audience, failed PKCE, missing/stale assurance, disabled account/session, token absence from browser storage, session fixation and CSRF denial, cross-employer and task-assignment denial, direct document access attempts, scanner outages, file replacement/version integrity, secret-free logs, bilingual auth flows, and keyboard/screen-reader checks. Infrastructure products, exact schemas, version pins and performance targets remain downstream.