docs operator access

Operator access runbook (P07-T02)

Restricted operator commands for moderation and privacy (BUC-006/BUC-007). There is no public admin HTTP path: privileged work runs through the ops CLI over controlled operator access only.

Access model

• Identity: --operator <id> flag or ANPFUEL_OPERATOR_ID environment. Anonymous invocations are denied before any work (ErrUnauthorized).
• Network: CLI runs on the operator machine with direct database access; the public API exposes no admin routes (/health/* and /metrics carry no admin capability; metrics stay on the private network).
• Credentials: database/R2 credentials follow the standard startup config (never printed, never committed). Rotate per incident procedure; revoke operator access by removing the identity at the access layer.
• MFA and allowlists live at the access layer per SECURITY_PRIVACY (admin CLI over restricted operator access with MFA); this runbook does not invent their configuration.

Commands

All commands append actor/reason/policy audit rows and move the case exactly once per action. Raw facts are never edited; appeals create new actions, cases or reviewed facts.

# Triage / resolve / dismiss any case (audit + status + recompute job, atomically)
go run ./cmd/ops moderation act --case <case-id> --action REVIEW --reason "triage note" --operator op-7

# Reviewed observation invalidation: audit INVALIDATE, then the community
# VALIDATED→REJECTED decision bound to the same case ID plus its
# consensus recompute job (observation must be VALIDATED)
go run ./cmd/ops moderation invalidate --case <case-id> --reason "confirmed fake price" --operator op-7

# Reviewed contributor block: audit BLOCK, then the trust BLOCKED verdict
# bound to the same case ID (contributor cases only)
go run ./cmd/ops moderation block --case <case-id> --reason "reviewed Sybil ring" --operator op-7

# Privileged evidence review: 60 s owner-independent download bound to an
# actionable case referencing exactly that evidence. The signed URL goes
# to stdout for the operator terminal only; the audit line on stderr
# carries actor/case/evidence/timestamp, never the URL.
go run ./cmd/ops evidence-url --case <case-id> --evidence-id <id> --operator op-7

Action/target rules: INVALIDATE on OBSERVATION/DISPUTE/EVIDENCE, BLOCK on CONTRIBUTOR, REVIEW/RESOLVE/DISMISS on any target. Closed cases never reopen; a two-step command that fails downstream reports audit <id> recorded so the follow-up is an audited retry, never a silent drop.

Appeal and recovery

• A disputed decision is appealed by recording a new action (e.g. RESOLVE with the review rationale) or by submitting a new reviewed observation referencing the old one; the original rows stay intact.
• Revoke a compromised operator identity at the access layer, then record DISMISS/RESOLVE corrections with the replacement identity.
• Projection rebuilds replay from the retained audit ledger; no manual SQL edits (unaudited manual SQL is a finding, not a procedure).

Retention and privacy notes

• Audit rows (moderation_actions) carry actor/action/reason only: no media, GPS, IPs or URLs (B-BR-011). Accountability retention per SECURITY_PRIVACY (12 months initially).
• Evidence downloads expire in 60 s; expired URLs are not retried, a new audited command mints a fresh one while the case stays actionable.
• Export/erasure workflows (BUC-007) land in P07-T03…T05 and reuse this access model; losing the contributor key never discloses data.