Workforce Identity, Warehouse Custody, Role-Based Access Control (RBAC), Segregation of Duties (SoD) & Forensic Audit Provenance Ledger
Establish bank-grade internal controls across your organization: provision staff accounts with primary warehouse custody and individual PO/Discount delegation limits; configure granular Role-Based Access Control (RBAC) matrices; detect toxic Segregation of Duties (SoD) conflicts before fraud can occur; and inspect the tamper-evident SHA-256 Forensic Audit & Inventory Provenance Ledger.
1. Plain-English Internal Controls 101: RBAC, Warehouse Custody, SoD & SHA-256 Hashing
1. Warehouse Custody & Financial Delegation
In Keystone X, permissions are not just "can this person view Inventory?" You can bind each staff member to a Primary Warehouse (`primary_warehouse_id`), control whether they can Receive GRNs, Dispatch Stock, or Approve Stock Adjustments, and cap their personal PO Approval Limit (`R`) and Maximum Quote/Invoice Discount (`%`).
2. Segregation of Duties (SoD)
Segregation of Duties (SoD) is the accounting rule that no single employee should control all stages of a high-risk transaction (for example, creating a fake supplier, approving a Purchase Order to that supplier, and logging the Goods Received Note). Keystone X's built-in SoD Conflict Analyzer scans every role and highlights toxic permission combinations automatically!
3. SHA-256 Tamper-Evident Audit Signatures
Every action in Keystone X is recorded in the Forensic Audit Trail with a cryptographic SHA-256 digital fingerprint (`event_hash`) computed from the timestamp, operator, action, entity reference, IP address, and description. Clicking Verify SHA-256 Integrity (`AuditLog/verifyIntegrity`) proves mathematically to external auditors that not a single historical log row has been altered in the database.
2. Workforce Identity & Warehouse Custody Command Center (`admin/users`)
Navigate to System Administration → Staff & Users (`admin/users`). The workspace features 6 Workforce Telemetry KPI cards and a **4-Mode Pipeline**:
- Mode 1 — Staff Directory (`?mode=directory`): Master table of all employees (`EMP-0001`) showing Name, Job Title, Department, Assigned Security Role badge, Primary Warehouse Custody, Operational Privileges (`GRN` / `Dispatch` / `Stock Adj`), Financial Limits (`PO Cap` / `Max Disc %`), Hourly Billing Rate (`R/hr`), Status (`Active`, `On Leave`, `Suspended`), and Last Login timestamp.
- Mode 2 — Warehouse Custody & Delegation Matrix (`?mode=custody`): An interactive inline grid (`admin/updateUserCustody/{id}`) allowing administrators to update any user's Primary Warehouse, GRN/Dispatch/Adjustment checkboxes, PO Approval Limit, and Discount Cap in one click!
- Mode 3 — PSA Billing & Operational Workload (`?mode=workload`): Shows each staff member's hourly charge-out rate (`hourly_billing_rate`), assigned Tasks, active Field Service Job Cards, and Support Tickets.
- Mode 4 — Access Security & Session Posture (`?mode=security`): Audits password hygiene, MFA enforcement (`mfa_enforced`), forced password resets (`must_change_password`), and login history.
📸 SCREENSHOT PLACEHOLDER: admin-users-workforce-custody-command-center.png
- Navigate to
admin/users?mode=directory. - Capture the Workforce Identity Command Center showing the 6 KPI cards, the 4-Mode pipeline strip, and the Staff Directory table with Warehouse Custody and Financial Delegation badges.
3. Provisioning Staff (`addUser` / `editUser`) & 360° Staff Dossier (`inspectUser/{id}`)
Clicking **+ Add Staff Member** (`admin/addUser`) or **Edit** (`admin/editUser/{id}`) configures:
- Identity & HR Profile: `employee_code` (`EMP-0001`), `first_name`, `last_name`, `job_title`, `department`, `email`, `phone`, `role_id`, and `status` (`Active`, `On Leave`, `Suspended`).
- Warehouse & Supply Chain Custody: `primary_warehouse_id`, `can_receive_grn` (allowed to sign off Goods Received Notes), `can_dispatch_stock` (allowed to release delivery notes/job card parts), and `can_approve_stock_adjustments` (allowed to post stocktake variances).
- Financial Delegation & PSA Rate: `custom_po_approval_limit` (`R` override above/below role default), `custom_discount_limit_pct` (`%` maximum line discount allowed on quotes/invoices), and `hourly_billing_rate` (`R/hr` used when converting logged task/project hours into customer invoices).
- Security Controls: `mfa_enforced`, `must_change_password` on next login, and password credentials.
Clicking **Inspect** (`admin/inspectUser/{id}`) opens the **360° Staff Dossier & Warehouse Custody Inspector**, displaying the employee's complete permission footprint, warehouse authority, recent forensic audit actions, and assigned operational workload.
4. Enterprise Roles, Cross-Role Permission Matrix & SoD Radar (`admin/roles`)
Navigate to System Administration → Roles & Permissions (RBAC) (`admin/roles`).
📸 SCREENSHOT PLACEHOLDER: admin-roles-rbac-matrix-and-sod-radar.png
- Navigate to
admin/roles?mode=matrix(or?mode=directory). - Capture the RBAC Command Center showing the 6 Security KPI cards, the 4-Mode Workflow Pipeline (`1. Roles & Industry Blueprints`, `2. Cross-Role Permission Matrix`, `3. Segregation of Duties (SoD) Radar`, `4. RBAC Security Audit Log`), and the interactive permission matrix.
| RBAC Mode / Feature | Capabilities & Governance Controls |
|---|---|
| Mode 1: Roles Register & 1-Click Industry Blueprints ( ?mode=directory) |
View all configured roles (`ROL-001`), Security Clearance Levels (`Level 1` Operational to `Level 5` Executive), PO/Expense/Discount limits, assigned user counts, and SoD health badges. Includes **1-Click Industry Role Blueprints** (`admin/provisionBlueprint/{key}`) for *Financial Controller / Bookkeeper*, *Warehouse & Inventory Manager*, *Procurement & GRN Officer*, *Senior Sales Executive*, *Field Service Technician*, and *External Auditor (Read-Only)*, plus 1-click **Clone Role** (`admin/cloneRole/{id}`). |
| Mode 2: Cross-Role Permission Matrix ( ?mode=matrix) |
Displays every permission in Keystone X (grouped by ERP domain: Sales, Inventory, Procurement, Accounting, Field Service, System Admin) as rows and every Role as columns. Toggle checkboxes across multiple roles simultaneously and click **Save Permission Matrix** (`admin/saveRoleMatrix`)—active user sessions synchronize immediately! |
| Mode 3: Segregation of Duties (SoD) Conflict Radar ( ?mode=sod) |
Scans all custom roles against statutory internal control rules (e.g., SOD-01 Procurement Creation + GRN Receiving + Expense Payout; SOD-02 Invoice Issuance + Credit Note Approval + Receipt Clearing; SOD-03 Stock Adjustment + Cost Price Editing). If rbac_block_critical_sod is enabled in RBAC Settings, Keystone X blocks saving any role that introduces a Critical SoD violation! |
| Mode 4: RBAC Security Audit Log ( ?mode=audit) |
Dedicated chronological log of all role creations, permission edits, blueprint deployments, and user role reassignments (`admin/reassignUserRole`). |
5. Forensic Audit Trail, Inventory Provenance & SHA-256 Verification (`AuditLog/*`)
Navigate to System Administration → Forensic Audit Logs (`AuditLog/index`). Every create, update, status transition, login, export, and stock movement across Keystone X is captured in a 4-mode forensic command center:
📸 SCREENSHOT PLACEHOLDER: audit-log-forensic-stream-and-sha256.png
- Navigate to
AuditLog/index?mode=stream. - Capture the Forensic Audit Command Center showing the top-right Verify SHA-256 Integrity and Export Compliance CSV buttons, the 6 KPI cards, the 4-Mode pipeline (`1. Forensic Event Stream`, `2. Unified Inventory Provenance`, `3. Security & Anomaly Radar`, `4. Operator & Domain Telemetry`), and the signed event table.
- Mode 1 — Forensic Event Stream (`?mode=stream`): Filterable by ERP Domain, Severity (`Info`, `Notice`, `Warning`, `Critical`), Action Code, Operator, Date Range, and free-text search. Click **Inspect** (`AuditLog/inspect/{id}`) on any row to view its **Forensic Event & SHA-256 Certificate Inspector**, showing the full HTTP method, IP address, User-Agent string, Entity Reference, and live SHA-256 hash verification certificate.
- Mode 2 — Unified Inventory Provenance (`?mode=inventory`): Combines stock movements, warehouse transfers, GRN intakes, serial number assignments, and stocktake adjustments into a single chain-of-custody ledger.
- Mode 3 — Security & Anomaly Radar (`?mode=security`): Highlights failed login attempts, destructive deletions (`DELETE_*`), permission escalations, and off-hours activity outside your configured business hours (`aud_business_hours_start` to `aud_business_hours_end`).
- Mode 4 — Operator & Domain Telemetry (`?mode=analytics`): Visualizes activity volume by staff member and ERP module domain.
- 1-Click Cryptographic Verification & CSV Export: Click **Verify SHA-256 Integrity** (`AuditLog/verifyIntegrity`) to re-hash and validate the entire audit database in real time, or click **Export CSV** (`AuditLog/exportCsv`) to download a signed compliance spreadsheet for your external auditors.
6. Workforce, RBAC & Forensic Audit Governance Studios
- Workforce Identity Studio (`admin/userSettings`): Configure Employee Code prefix (`EMP-`), default onboarding Role & Warehouse, minimum password length (`ug_min_password_length`), session idle timeout, and default PSA hourly billing rate.
- RBAC Security Studio (`admin/roleSettings`): Configure Role Code prefix (`ROL-`), default PO/Expense/Discount caps for new roles, toggle Block Saving Roles with Critical SoD Conflicts (`rbac_block_critical_sod`), and toggle Live Session Permission Refresh on Role Update.
- Forensic Audit Studio (`AuditLog/settings` — 3 Tabs): Configure Capture Depth (`aud_capture_user_agent`, `aud_track_inventory_movements`), Severity & Off-Hours Radar (`aud_flag_destructive_actions`, `aud_flag_off_hours_activity`, business hours window), and Compliance Retention (`aud_enable_sha256_signing`, `aud_immutable_lock`, `aud_retention_days`).