# Security and audit

## Demo authentication

Role buttons may create a session for a seeded demo identity. All API routes still enforce authorization. Demo reset and customer merge require Operations Manager.

## Service authentication

Use separate scoped credentials for:

- n8n callbacks;
- MCP Hub provider calls;
- RAGcore calls.

Never reuse browser session secrets.

## Sensitive data

All data are synthetic, but design as though data were sensitive:

- do not log full tokens;
- avoid logging complete customer payloads;
- validate and size-limit free-text inputs;
- escape rendered content;
- use CSRF protection for cookie sessions or use a secure token model;
- restrictive CORS;
- secrets from environment or mounted secret files.

## Audit events

Required actions:

- demo login;
- return registration;
- vehicle status change;
- data-quality issue creation and resolution;
- customer merge;
- workflow retry;
- demo reset;
- MCP provider request;
- knowledge question status and source IDs.

Audit is append-only through the application. Provide filters by actor, action, entity and correlation ID.

## Confirmation

No write-capable MCP actions exist in this PoC. Destructive UI actions such as demo reset and customer merge require explicit confirmation.