Initial MobilityOps build pack (docs, contracts, scaffold)

docs/12-security-and-audit.md

@@ -0,0 +1,47 @@
+# Security and audit
+
+## Demo authentication
+
+Role buttons may create a session for a seeded demo identity. All API routes still enforce authorization. Demo reset and customer merge require Operations Manager.
+
+## Service authentication
+
+Use separate scoped credentials for:
+
+- n8n callbacks;
+- MCP Hub provider calls;
+- RAGcore calls.
+
+Never reuse browser session secrets.
+
+## Sensitive data
+
+All data are synthetic, but design as though data were sensitive:
+
+- do not log full tokens;
+- avoid logging complete customer payloads;
+- validate and size-limit free-text inputs;
+- escape rendered content;
+- use CSRF protection for cookie sessions or use a secure token model;
+- restrictive CORS;
+- secrets from environment or mounted secret files.
+
+## Audit events
+
+Required actions:
+
+- demo login;
+- return registration;
+- vehicle status change;
+- data-quality issue creation and resolution;
+- customer merge;
+- workflow retry;
+- demo reset;
+- MCP provider request;
+- knowledge question status and source IDs.
+
+Audit is append-only through the application. Provide filters by actor, action, entity and correlation ID.
+
+## Confirmation
+
+No write-capable MCP actions exist in this PoC. Destructive UI actions such as demo reset and customer merge require explicit confirmation.