FedCredIQ Secure Configuration Guide

FedCredIQ is deliberately secure-by-default: most security decisions are platform-fixed and cannot be weakened by any account. What remains configurable is the people surface — who is in your agency, what role they hold, and whether their account is active. This guide explains that surface, its security implications, and the recommended practices. A machine-readable settings inventory is published alongside at /secure-configuration-guide.json.

How accounts are named

Name in product	FedRAMP term	Who
Admin	Top-level administrative account (for your organization)	Your agency's administrators: invite, edit, assign roles, disable/enable, and remove the agency's users — within your agency only
User	Standard account	Agency analysts: full modeling functionality within the agency's data
Super Admin	Provider-side — not a customer account	Lytix operations staff, governed by Lytix's published access-management policy. Not operable or grantable by customers

There are no other roles, no API keys, no service accounts, and no self-registration — every account is created by an administrator's invite.

Administrative accounts: access, operate, decommission

Access: sign-in is passwordless. A new account signs in once with an emailed one-time code, then must enroll a passkey (device biometric or security key); from then on the passkey is the only sign-in method. Enroll at least two passkeys, and use a government email address your agency controls — email is the invite and recovery anchor. Sessions last at most 12 hours; neither lifetime is configurable.
Operate: invite with the User role by default and grant Admin only to people who administer accounts — every Admin can manage every account in the agency, including other Admins. Keep at least two Admins per agency. Changes (invites, roles, disables) take effect within about 30 seconds.
Decommission: disable first, delete later. Disabling blocks sign-in and cuts off API access within seconds, and is reversible. Deletion permanently removes the sign-in identity, passkeys, profile, and the person's AI-assistant transcripts; their published model runs remain as agency work product. Whole-agency offboarding is performed by Lytix under the documented data-removal procedure — request via security@lytix.xyz.

Admin-only settings and their implications

Setting / action	Security implication
Invite user	Grants access to all of the agency's data in FedCredIQ. There is no finer-than-agency data permission, so inviting is the data-access decision
Role assignment (User ↔ Admin)	Admin can manage every account in the agency. Least privilege: default to User
Disable / re-enable account	The revocation control: blocks sign-in and revokes API access within seconds. Prefer over deletion for departures and suspicion
Delete user	Irreversible identity and transcript removal; published runs remain
Edit another user's email	Re-points account recovery — treat like issuing a credential
Upload / replace / remove the agency's SubsidyCLI	The binary carries the agency's OMB credential and runs in the boundary for every CSC calculation. Upload only the copy OMB issued to your agency; its recorded hash is verified before each run

Settings every user operates

Setting / action	Security implication
Passkey add/remove (own account)	Removing the last passkey demotes sign-in to emailed codes until a new passkey is enrolled — re-enroll immediately
Publish / unpublish a model run	The product's only visibility control: drafts are author-only; publishing makes the run the agency-wide record. Nothing is ever visible outside the agency
File upload	Uploads are encrypted in the agency's own storage partition and visible to the whole agency
Self-service account deletion	Same finality as admin deletion

Secure defaults — fixed, not configurable

No account, including Admins, can weaken these: passwordless-only authentication (no passwords exist anywhere), mandatory passkey enrollment, server-side agency tenancy on every query and file path, TLS in transit and KMS encryption at rest, fixed session policy (1-hour tokens, 12-hour maximum session, server-side revocation), no API keys/webhooks/third-party integrations, and no self-registration. Newly provisioned accounts therefore start — and stay — at the recommended secure configuration.

Provider-operated administration

Performed only by Lytix on documented request from an agency Admin or the agency's contracting authority via security@lytix.xyz: agency creation, moving a user between agencies, and whole-agency deletion.