AurumShield.

🔐 Role-Based Access Control

Implemented in authz.ts, the authorization system defines a maker-checker RBAC model with strict role separation:

TRADER (Maker): Can initiate orders and lock prices.
TREASURY (Checker/Approver): Reviews, approves, and executes DvP via JIT WebAuthn signature.

Capability Ladder: BROWSE → QUOTE → LOCK_PRICE → EXECUTE_PURCHASE → SETTLE

Protected capabilities (LOCK_PRICE+) require a database-verified APPROVED compliance case, valid LEI, and correct organizational role. If roles or LEIs are missing, access is denied by default. Authentication enforced via Hardware Key/WebAuthn and Enterprise SSO (SAML/OIDC). SMS OTP removed.

🛡️ JIT Biometric Execution Binding

When the TREASURY (Checker) clicks "Approve & Execute DvP", a native WebAuthn/Passkey signature prompt (navigator.credentials.get()) is triggered. This signature is cryptographically bound to the canonicalized SHA-256 payload of the settlement document and stored in the order_approvals table with checker_user_id, signature_hash, and timestamp.

📋 Forensic Audit Logging

The audit logger (audit-logger.ts) produces append-only, structured JSON events written to stdout for CloudWatch/Datadog capture. Each event carries a deterministic SHA-256 event ID computed from timestamp + event name + payload — ensuring the same event cannot be emitted twice and providing tamper-evident verification. Policy snapshots are SHA-256 hashed at order creation — any later tampering is detectable.

🔑 Encryption Protocols

At Rest: RDS PostgreSQL 15 with storage_encrypted = true (AES-256 via AWS KMS). Database credentials auto-managed by RDS and stored in AWS Secrets Manager — never in Terraform state or environment variables. S3 document storage uses server-side encryption.

In Transit: All external traffic terminates at AWS ALB with ACM-provisioned TLS certificates. Webhook payloads from Column Bank are verified using HMAC-SHA256 with timing-safe comparison (webhook-verify.ts) to prevent timing attacks. Clearing certificates signed with AWS KMS ECDSA for non-repudiation.

🌐 Network Security

The infrastructure implements three-tier Security Group isolation defined in Terraform:

ALB SG: 80/443 inbound from 0.0.0.0/0 (public internet)
App SG: Port 3000 inbound from ALB SG only
DB SG: Port 5432 inbound from App SG only

ECS tasks run in private subnets with no public IP. Outbound routes through NAT Gateway. Database is not publicly accessible. This ensures zero direct public access to containers or database.

⚡ Capital Controls & Breach Monitoring

The capital controls engine evaluates real-time capital snapshots, pre-funded 5% collateral locks from CorporateWallets, and enforces 5 escalating control modes:

NORMAL → THROTTLE_RESERVATIONS → FREEZE_CONVERSIONS → FREEZE_MARKETPLACE → EMERGENCY_HALT

Failed T+1 wires transition to SLASH_COLLATERAL, penalizing the defaulting organization. The multi-oracle circuit breaker triggers FREEZE if pricing feed divergence exceeds 15 bps. All financial values stored as BIGINT (cents/basis points) — no floating-point math.

Frontend

Backend & Data

Settlement & Payments

Logistics