Settings & Admin
The two settings routers — organization settings (account, team, security posture, audit) and project settings (sources, members, modes & surfaces, danger zone).
Two settings routers: Organization settings (app-settings.jsx, under /settings/*) and Project settings (app-project-settings.jsx, under /project/*). Both use a shared left-sub-nav layout. Bare /settings redirects to /settings/account. Every actionable control gives feedback (a modal, navigation, or a toast).
Organization settings (/settings/*)
Overview (/settings/overview)
Org summary + quick links into the other sub-routes (connector catalog, canonical model, API keys, security, notifications…).
Account (/settings/account)
- Profile — name, email; SAVE CHANGES → success toast.
- Password & MFA —
CHANGEreveals an inline new/confirm-password panel (UPDATE PASSWORD → success toast);MANAGEreveals an inline MFA panel (view recovery codes / re-pair device / disable MFA). - Active sessions — device list with REVOKE per session (warn toast).
Team (/settings/team)
Member roster (name, email, role, last-active, MFA). + INVITE MEMBER opens an invite modal (email + role → success toast); per-row MANAGE opens a manage modal (role picker, reset password, require MFA, REMOVE → warn toast).
Organizations / Tenants (/settings/tenants)
The orgs you can access (each isolated — own DB, KMS, Claude budget). + NEW ORGANIZATION (info toast), per-org SWITCH TO (success toast) and SETTINGS (info toast). Doctrine: projects live inside an organization.
Connector catalog (/settings/data)
The org library of source connectors across families. + ADD CONNECTOR points to the Ontology Agent (info toast with an "ONBOARD A SOURCE" action link → /sources/onboard). An "add a new source" section frames the onboarding entry point.
Canonical model (/settings/canonical)
Inspect the Source→Observation→Entity→Event→Case→Report schemas — the shared contract for every project.
API keys (/settings/api)
Active keys with scope/usage/rate. + CREATE KEY (success toast — key shown once), ROTATE (success), REVOKE (warn). Includes a documentation block (query examples).
Security (/settings/security) — the security posture
Eight posture rows, each with status + a CONFIGURE button opening an adaptive ConfigureModal:
| Row | Status | Configure surface |
|---|---|---|
| Isolation | enforced | read-only parameter panel (single-tenant DB, your KMS, dedicated compute, region) |
| MFA | enabled | required-methods select + "enforce for all roles" toggle |
| SSO / OIDC | not configured | provider picker (Okta/Entra/Google/Generic) + metadata URL + Connect |
| Data residency | configurable | primary-region select (CH default / EU / US / custom) |
| Encryption | enforced | read-only parameters (TLS 1.3 / AES-256 / KMS / field-level PII) |
| Audit retention | 13 months | retention-window select (engagement+12mo / +24mo / 7yr / indefinite) |
| BYOK | not used | KMS key ARN input + enable toggle (Pro+) |
| IP allowlist | not configured | CIDR-ranges textarea |
| Saving any fires a success toast ("…updated · logged to audit"). |
Per-incident support access (doctrine Q3): insigz support has no standing access. + GRANT SUPPORT ACCESS opens a grant modal (named engineer, scoped to one incident, time-boxed, read-only); active grants list with REVOKE NOW (warn toast). No cross-tenant staff console exists.
Notifications (/settings/notifications)
The alert-rule editor backing the inbox. A channel-summary grid (per alert type: active/total), a type filter row, and rule rows: a live on/off toggle, the rule (type badge, id, name, WHEN · scope), channel chips (inbox/email/slack/sms), EDIT (opens the rule editor prefilled → success toast), DELETE (warn toast). + NEW RULE opens the create modal (type/name/scope → success toast). Footer notes injects flow into this same model (Q6).
Billing (/settings/billing)
Plan + usage. UPGRADE TO PRO (success toast), CHANGE PLAN (info toast).
Audit log (/settings/audit)
Append-only event log with filters and EXPORT CSV (info toast — "preparing export"). The compliance evidence trail every grant/read/approval lands in.
Project settings (/project/*, app-project-settings.jsx)
A two-column layout headed by the active project.
- Overview — project name (editable + save → updateProject), blueprint, region.
- Sources (
/project/sources) — connected feeds with remove; + ADD SOURCE opens the org-catalog picker to connect feeds into this project (eachaddwires a source). - Members (
/project/members) — project-scoped roster; ＋ INVITE → success toast (org owners manage the full roster under org settings). - Modes & surfaces — toggle the project's modes (Live-ops / Research) and surfaces (Explore, Cases, Reports, Sources, Sessions, Workshop). This is what makes the wargame surfaces appear/hide.
toggleSurface(k)flips a surface;setDefault(m)sets the default mode. - Canonical — the project's source→…→report chain summary.
- Danger zone — delete project (type-to-confirm; requires >1 project).
The Wargame Extension
An optional Strategy-Day layer — role-scoped cells, phased turns, an AI Adjudicator drafting consequences with faculty as umpire, and a signed After-Action Report.
Notifications, Status & UX Patterns
The five-type alert model and inbox, the global toast system, the dead-end-closure pattern, and the responsive and accessibility patterns across the platform.