Demo mode — every action is simulated in-browser against a self-contained mock. Set NEXT_PUBLIC_API_BASE to point the same client at the live SS-01 / SS-10 APIs.

Database users & roles

Per-claim roles whose credentials are Vault dynamic leases (≤1h TTL), never static passwords. A stolen credential has a one-hour blast radius.

7Roles

6Active

≤1hMax lease TTL

0Static passwords

Static passwords in env, Git or ConfigMaps are denied platform-wide by Kyverno.