Compliance

1. 1

   Gate admin routes

   Security and audit surfaces should only render after server-side access checks.

   • src/app/(dashboard)/admin/security/page.tsx
   • src/lib/auth/guards/route.ts
2. 2

   Read security and permission state

   Dashboard cards and permission matrix exports are assembled from compliance-owned server queries.

   • src/features/compliance/server/security/queries.ts
   • src/features/compliance/server/permissions/matrix-query.ts
3. 3

   Redact audit fields by role

   Audit descriptions, values, and redaction helpers keep logs useful without exposing raw sensitive payloads.

   • src/features/compliance/server/audit/query.ts
   • src/features/compliance/server/audit/redaction.ts
   • src/features/compliance/server/audit/values.ts
4. 4

   Run retention as protected work

   Retention cleanup is handled by the compliance service behind the protected cron route.

   • src/features/compliance/server/retention/service.ts

Source: src/features/compliance/server/audit/redaction.ts

Profile audit entries preserve role changes but remove raw metadata and sensitive state.

if (entry.entityType === "profile") {
  return {
    ...entry,
    actorEmail: maskedActorEmail,
    targetLabel: maskedTargetLabel,
    description: maskedDescription,
    metadata: {},
    beforeState: pickObjectKeys(entry.beforeState, ["role"]),
    afterState: pickObjectKeys(entry.afterState, ["role"]),
    redacted: true,
  };
}