Security alerts

Hard locks, access requests and unusual sign in patterns.

Acceptance criteria

US-54 Account Lockout + Admin Unlock HIGHEST NEW SCREEN

As an administrator, I want the ability to manually unlock accounts, so that locked users can be recovered under control.

Lockout policy: threshold (failed attempts before soft-lock): 5, Lock duration (auto-unlock): 15 mins, Counter Reset: after every successful login.
Admin can manually unlock a locked account.
Given an account soft-locks 3 times within 24 hours, when the 3rd lock occurs, then it becomes a hard lock requiring admin unlock (no auto-unlock).
Given a hard lock or a suspicious pattern (multiple accounts locking, or one account from many sources), when detected, then an admin is notified via in-app alert and email.
Given a hard lock, when the admin reviews it, then the failed-attempt history (from the audit log) is visible to support the decision.

US-45 RBAC: Named Roles + CRUD Matrix HIGHEST NEW SCREEN

As an administrator, I want named roles with enforced CRUD permissions, so that each user type can only perform the actions appropriate to their job.

Ship named roles: admin, receptionist, insurance approval officer, claims officer, A/R, A/P.
CRUD permissions per role enforced on module actions (create/read/update/delete gated per role).
A user's role determines which modules/actions are visible and permitted.
Buttons/actions scope only (for row-level data isolation see US-52b).

OP-10 Audit coverage and break-glass P1 OPERATIONAL REVIEW

As a compliance owner, I need every sensitive action logged and a sealed emergency account, so nothing happens unseen.

The audit log also records cancel, quarantine replay, assign, take over, export and an administrator opening a clinical or finance record.
An administrator cannot change their own role. The attempt is blocked and logged.
Signing in with the break-glass account raises a security alert and an email to the other administrators.

Wireframe state

DefaultEmptyAccess requestBreak glass

Email sent to the other administrators. The email went to the other administrators. Nobody can use the account silently.

Security alerts

Alert rules

Level	Alert	When	Sent	Status
High	Break-glass account signed inBreak-glass administrator, sealed by Compliance. From 10.20.1.5, Edge on Windows. Purpose on file: emergency access to restore sign in.	Today 06:12	In portal, email	Open	Acknowledge See the audit entry
High	Account hard lockedTurki Al-Anazi, 3 soft locks in 24 hours	4 Oct 17:44	In portal, email	Open	Review
High	Several accounts locked3 accounts from 10.20.4.31 in 20 minutes	4 Oct 17:50	In portal, email	Open	Review
Medium	One account, many sourcesDalal Al-Rashid tried from 5 addresses	3 Oct 22:14	In portal, email	Resolved	Review
Low	Password reset requestedLayla Al-Harbi, 3 requests in one hour	1 Oct 10:03	In portal	Resolved	Review

Email sent to administrators

To: All administrators (2)
Subject: Security alert: break-glass account signed in

The break-glass administrator signed in on 5 Oct 2026 at 06:12 from 10.20.1.5.

This account is sealed by Compliance and every sign in raises this alert.

Open Security alerts in the portal and acknowledge it once you know why it was used.

The same alert also appears here and on the bell.

Who is told

Email recipients

Show a red dot on the bellRepeat the email every 4 hours until reviewed

Security alerts

Alert rules

Level	Alert	When	Sent	Status
High	Break-glass account signed inBreak-glass administrator, sealed by Compliance. From 10.20.1.5, Edge on Windows. Purpose on file: emergency access to restore sign in.	Today 06:12	In portal, email	Open	Acknowledge See the audit entry
High	Account hard lockedTurki Al-Anazi, 3 soft locks in 24 hours	4 Oct 17:44	In portal, email	Open	Review
High	Several accounts locked3 accounts from 10.20.4.31 in 20 minutes	4 Oct 17:50	In portal, email	Open	Review
Medium	One account, many sourcesDalal Al-Rashid tried from 5 addresses	3 Oct 22:14	In portal, email	Resolved	Review
Low	Password reset requestedLayla Al-Harbi, 3 requests in one hour	1 Oct 10:03	In portal	Resolved	Review

Email sent to administrators

To: All administrators (2)
Subject: Security alert: account hard locked, Turki Al-Anazi

Turki Al-Anazi was hard locked on 4 Oct 2026 at 17:44 after 3 soft locks in 24 hours.

The failed attempts came from 10.20.7.18 and 10.20.4.31.

Open Locked accounts in the portal to review and unlock.

The same alert also appears here and on the bell.

Who is told

Email recipients

Show a red dot on the bellRepeat the email every 4 hours until reviewed

Security alerts

Alert rules

Level	Alert	When	Sent	Status
Medium	Access request from Layla Al-HarbiReceptionist, Facility A. Asked for Settings: "I need to check a locked account for a colleague."	Today 09:05	In portal, email	Open	Open userSee roles
High	Break-glass account signed inBreak-glass administrator, sealed by Compliance. From 10.20.1.5, Edge on Windows. Purpose on file: emergency access to restore sign in.	Today 06:12	In portal, email	Open	Acknowledge See the audit entry
High	Account hard lockedTurki Al-Anazi, 3 soft locks in 24 hours	4 Oct 17:44	In portal, email	Open	Review
High	Several accounts locked3 accounts from 10.20.4.31 in 20 minutes	4 Oct 17:50	In portal, email	Open	Review
Medium	One account, many sourcesDalal Al-Rashid tried from 5 addresses	3 Oct 22:14	In portal, email	Resolved	Review
Low	Password reset requestedLayla Al-Harbi, 3 requests in one hour	1 Oct 10:03	In portal	Resolved	Review

Email sent to administrators

To: All administrators (2)
Subject: Access request from Layla Al-Harbi

Layla Al-Harbi (Receptionist, Facility A) asked for access to Settings on 5 Oct 2026 at 09:05.

Reason given: "I need to check a locked account for a colleague."

Open her user page to change the role, or ignore the request. Either way it is logged.

The same alert also appears here and on the bell.

Who is told

Email recipients

Show a red dot on the bellRepeat the email every 4 hours until reviewed

No security alerts

Hard locks and unusual sign in patterns appear here, and are sent to you by email.

Alert rules