02.3 — Engine 3: Control (RBAC, audit, signing)

The Invariant

Every mutation is attributable and every artifact is verifiable without trusting the platform. Identity comes from authenticated sessions and manifest-declared roles; the audit chain is hash-linked per tenant; manifests, licenses, ingest batches and public verification payloads are Ed25519-signed — anyone holding the public key can check them.

The Contract

• RBAC engine — rbac_engine.roles and permissions in the manifest map roles → allowed triggers. Denial is fail-closed (403), enforced inside the action pipeline.
• Audit chain — each audit row carries prev_hash; GET /api/v1/audit/verify (edge) and …/tenant/audit/verify, …/admin/audit/verify (Control Plane) re-validate the chain.
• Signing — production manifests and licenses are signed with MANIFEST_PRIVATE_KEY / PLUGIN_PRIVATE_KEY (Ed25519). The edge verifies against MANIFEST_PUBLIC_KEYS / PLUGIN_PUBLIC_KEYS before activation. HMAC fallback exists for development only — NODE_ENV=production fails closed without Ed25519 keys.
• Device identity — edge nodes sign ingest batches (x-edge-signature) with the keypair issued at bootstrap claim.

The Flow

1. An operator action hits the pipeline; RBAC checks the session roles against rbac_engine.permissions.
2. On commit, the audit row is appended with the hash of the previous row — tampering any link invalidates the chain.
3. The Control Plane publishes manifests after validating the signature; the edge verifies before swapping is_active.
4. Sync batches arrive signed; the Control Plane re-verifies against the node’s registered pubkey and stores the batch as re-checkable evidence.
5. GET /api/v1/public/verify/event/:id lets a third party verify a committed event — no tenant credentials required.

Payload Example

# Verify the tenant audit chain end-to-end (Control Plane)
curl -s https://cp.axiom-trace.eu/api/v1/tenant/audit/verify \
  -H "Authorization: Bearer $PORTAL_SESSION"
# → { "ok": true, "checked": 4811, "head": "9f2c…" }

# Public oracle — verify a single event's audit trail, no credentials
curl -s https://cp.axiom-trace.eu/api/v1/public/verify/event/$EVENT_ID
# → { "valid": true, "chain_depth": 12, … }

Known Failures