Security governance
modules/dashboard/pages/{SecurityExceptionsUI, SecurityPolicyCenterUI, ComplianceCasesUI, complianceShared} — maker-checker workflows, all real-money/compliance-adjacent.
Exceptions Center — Live
Route: /dashboard/reports/security-flags/exceptions
Staff create, review, approve, activate, and govern scoped exception rules that suppress or force manual review of security-flag detections — plus ownership, expiry/recertification, emergency-disable, and operational-intelligence workflows.
Sub-modules (25 files)
- ExceptionConditionsBuilder — Add/remove/edit match-rule condition rows, quick-adds, suggestions from source flag
- ApprovalWorkflowPanel / ApprovalRequirementsPanel — Approval history/timeline; risk level + required approver role
- AssignOwnerModal / ExtendExpiryModal / EmergencyDisableModal — Single or bulk owner assignment; expiry extension; emergency-disable (reason required)
- BulkGovernanceBar / BulkConfirmModal — Floating bulk-action bar + confirmation
- RecertificationTable / RecertificationReviewDrawer — Pending recertifications queue + Keep Active/Revoke review
- ExpiringSoonTable — Rules expiring soon — Review/Extend/Revoke row actions
- OperationsCommandCenter — Ops tab — dashboard, intelligence, review queue, rule health, staged activation, CSV export
- ExceptionOpsActionsMenu — Per-row "⋮": Clone as Draft, Run Simulation, Compliance Report, Emergency Disable/Clear
- GovernanceReportPanel / OperationalTimelinePanel — Summary cards + chronological lifecycle+audit event timeline
Actions available (28)
| Action | Effect | Hook | Stage |
|---|---|---|---|
| Create Rule / Save Draft | Opens blank drawer, validates + creates/updates | useCreateExceptionRuleMutation/useUpdateExceptionRuleMutation | draft |
| Add/remove condition, add suggested/quick-add | Client-side condition builder | — | draft |
| Preview Impact | Dry-run affected-flags preview | usePreviewExceptionRuleMutation | draft |
| Run Simulation | Simulates matching against sample/historical flags | useSimulateExceptionRuleMutation | any |
| Activate / Activate Immediately (bypass) | Standard requires approval; bypass needs reason + typed confirmation + risk ack | useActivateExceptionRuleMutation | → active or pending_approval |
| Submit For Approval / Approve / Reject | Maker-checker queue | useSubmitExceptionApprovalMutation, useApprove/RejectExceptionMutation | draft ↔ pending_approval |
| Edit / Clone as Draft | Opens prefilled drawer / duplicates into new draft | useCloneExceptionRuleMutation | any |
| Revoke | Permanent, reason required | useRevokeExceptionRuleMutation | → revoked |
| Emergency Disable / Clear | Immediately stops matching / restores | useEmergencyDisableExceptionMutation/useClearEmergencyDisableExceptionMutation | active |
| Compliance Report | Opens per-rule report in new tab | window.open | any |
| Extend Expiry (single/bulk) | New expiry date + reason | useExtendExceptionMutation/useBulkExtendMutation | active |
| Assign/Change Owner (single/bulk) | Owner user + team + reason | useAssignExceptionOwnerMutation/useBulkAssignOwnerMutation | any |
| Bulk: Request Recertification / Activate Immediately | Batch operations across selected rules | useBulkRequestRecertificationMutation, useBulkActivateExceptionRulesMutation | varies |
| Recertification: Keep Active / Revoke | Approves/rejects a recertification review | useApproveRecertificationMutation/useRejectRecertificationMutation | recert pending |
| Start / Complete Activation (Ops Command Center) | Staged engine-mode transition (log_only/active), typed confirmation on → active | useStartActivationMutation/useCompleteActivationMutation | ops |
| Refresh Intelligence / Export CSVs | Queues dashboard refresh / downloads ops CSVs | useExceptionIntelligenceRefreshMutation, window.open | ops |
Policy Center — Live
Route: /dashboard/reports/security-flags/policy-center
Governs the offense-escalation policy matrix that drives automated enforcement — view the active matrix, manage draft versions end-to-end (clone/edit/validate/preview-impact/review-approve/publish/rollback/migrate), compare versions, run a what-if simulator, view global audit, pause/resume automatic enforcement.
Sub-modules (~29 files)
- PolicyDraftVersionPanel — Draft workspace: rule list, create rule, validate, step tabs (rules/validation/impact/review/publish/migration/audit)
- PolicyFullRuleEditor / PolicyRuleRoutingEditor — Full rule create/edit/delete dialog; inline routing patch
- PolicyValidationSummaryPanel / PolicyImpactPanel — Blocking errors/warnings; activation-impact diff vs. active policy
- PolicyGovernancePanel — Review/Approval, Rollback, Emergency-pause, Audit sub-tabs
- PolicyActivationPreviewDialog — Final "Publish Policy" confirmation (reason, typed phrase, high-risk ack, optional superuser bypass)
- PolicyFlagMigrationPanel — Re-resolves already-created flags against a new policy version
- PolicyLifecycleTracker / PolicyOverviewDashboard / PolicyContextBar — Visual stepper; overview cards; active-version/draft-count status bar
- PolicyGlobalAuditPanel — Cross-version audit history
Actions available (22)
| Action | Effect | Hook | Stage |
|---|---|---|---|
| Clone draft (from active) | New editable draft version | usePolicyCenterCloneMutation | → draft |
| Create / Edit / Delete / Duplicate rule | Draft rule CRUD | usePolicyCenterCreate/Update/Delete/DuplicateRuleMutation | draft editing |
| Patch rule routing (inline) | Quick edit without full editor | usePolicyCenterPatchRuleRoutingMutation | draft editing |
| Validate draft | Surfaces blocking errors/warnings | usePolicyCenterValidateMutation | draft → validation |
| Refresh impact | Regenerates activation diff | usePolicyCenterActivationImpact | impact preview |
| Submit for review / Approve / Request Changes | Maker-checker on draft snapshot | usePolicyCenterSubmitReviewMutation, Approve/RequestChangesMutation | editing → review_requested → approved |
| Publish Policy (Activate) | Typed phrase ACTIVATE POLICY <code>, impact token, high-risk ack, optional superuser bypass | usePolicyCenterActivateMutation | approved → active |
| Preview rollback / Clone for rollback | Previews historical version, then clones a new draft from it | usePolicyCenterRollbackPreviewMutation, ...CloneForRollbackMutation | ops → new draft |
| Pause / Resume automatic enforcement | Emergency pause, reason + typed confirmation phrase both ways | usePolicyCenterEmergencyPauseMutation | ops |
| Preview / Apply flag migration | Dry-run then apply re-resolution of existing flags against a target version | usePolicyReresolutionPreviewMutation/...ApplyMutation | migration |
| Compare versions | Added/removed/changed rule diff | usePolicyCenterCompare | compare |
| Simulate | flag_type + offense_count → expected outcome | usePolicyCenterSimulatorMutation | simulator |
| Load audit history | Filter by event type / high-risk only | usePolicyCenterAuditHistory | audit |
Compliance Cases — Live
Route: /dashboard/reports/compliance-cases
Triage/investigation console for compliance cases (created from security flags elsewhere) — filter/queue, operations dashboard, and per-case assignment/notes/trader-communication/decision/close-reopen/audit-export via a detail drawer.
Sub-modules
- ComplianceCaseDetailModal — Overview/Investigation/Communication/Decision/Audit tabs; Actions menu (Resolve/Escalate/Request Info/Close/Reopen/Export)
- CaseCommunicationPanel — Trader-communication thread — information/document requests, responses, staff replies
- AuditPackagePanel — Per-case audit package generation/export + timeline
Actions available (17)
| Action | Effect | Hook | Stage |
|---|---|---|---|
| Assign Team / Assign to me | Assigns team or self-claims | useAssignComplianceCaseTeamMutation/UserMutation | any open |
| Add Note | Investigation note | useAddComplianceCaseNoteMutation | any open |
| Request Information/Document | Creates trader-facing request thread | custom mutation | investigating |
| Close Request / Send Reply | Closes a thread / staff reply (optionally sent to trader) | custom mutations | communication |
| Log Outgoing Email | Logs a staff-initiated communication record | useAddComplianceCaseCommunicationMutation | any |
| Record Decision — Resolve / Escalate / Request Information | Records decision with reason/taxonomy/impact | useComplianceCaseDecisionMutation | investigating |
| Close Case / Reopen Case | Reason required both ways; close also closes open trader requests | useCloseComplianceCaseMutation/useReopenComplianceCaseMutation | resolved↔closed↔investigating |
| Export JSON (case) / Generate + Download Package (audit) | Per-case export; audit-package generation + JSON download (PDF download present but disabled) | custom mutations, window.open | audit |
| Expand Operations Dashboard | Team workload, decision distribution, compliance report cards | — | — |
:::info Note
Case creation itself doesn't live on this page — cases are created from a security flag elsewhere (Manual Flags queue / flag-detail Actions) via useCreateComplianceCaseMutation. complianceShared/ (CompliancePageChrome, ComplianceQueueTabs) provides the shared header/tabs reused here and by compliance-mode Security Flags.
:::