Who can do what, and the record of what they did

Signing in

Officers sign in with their Microsoft work accounts through RODMENA ID. Microsoft asks which account to use each time. An officer who picked the wrong account can choose another at the next sign-in.

An officer keeps at most ten live sessions, and an eleventh sign-in ends the oldest. The profile page lists each session with a masked address and signs out the others in one step.

Roles and separation of duties

Each account has one of nine roles, and the server checks the role on every request. A viewer can read records and cannot change them.

The officer who writes a traffic order cannot approve or reject it. The system administrator manages accounts, fees and map layers, and that role holds no permission that changes works or orders.

The audit trail

Every action by an officer, a workflow or the Street Manager connector is written to the audit trail with who did it, when, and the reason they gave. Entries cannot be edited or deleted.

The connector monitor keeps the request and answer of each call to and from Street Manager. A disputed decision can be traced to exactly what was sent.

Documents and notices

Each statutory notice carries a SHA-256 hash on the order’s Notices tab. A printed or published copy can be matched against it.

Files people upload are checked for viruses before anyone can open them.

Phones in the field

The field app keeps copies of what it last showed so inspectors can work without a signal. Those copies expire after seven days and are deleted when the inspector signs out.

The public site and feeds

The public site and its feeds need no sign-in and show only what is published for residents. The public API is limited to 60 requests a minute for each client.

Visits to the public site are counted without cookies.

What goes into each release

Each release of the Fingerpost web app comes with a CycloneDX software bill of materials that lists the packages inside it.