{
  "service": "FedCredIQ",
  "provider": "Lytix LLC",
  "guideVersion": "1.0",
  "lastUpdated": "2026-09-22",
  "humanReadable": "https://fedcrediq.com/secure-configuration-guide.html",
  "accountTiers": [
    {
      "name": "Admin",
      "fedRampTerm": "Top-Level Administrative Account",
      "customerOperable": true,
      "description": "Agency administrators: manage the agency's own users (invite, edit, role assignment, enable/disable, delete) within that one agency only."
    },
    {
      "name": "User",
      "fedRampTerm": "Standard account",
      "customerOperable": true,
      "description": "Agency analysts: full modeling functionality within the agency's data."
    },
    {
      "name": "Super Admin",
      "fedRampTerm": "Provider-side staff role",
      "customerOperable": false,
      "description": "Lytix operations staff; cross-tenant; governed by Lytix's access-management policy. Not grantable by customers."
    }
  ],
  "settings": [
    {
      "id": "invite-user",
      "name": "Invite user",
      "operableBy": ["Admin"],
      "default": "Role 'User'; invitee lands in the inviting Admin's agency",
      "recommendedValue": "Invite with role 'User'; grant 'Admin' only to account administrators",
      "implication": "Grants access to all of the agency's data; inviting is the data-access decision (no finer-than-agency permission exists)."
    },
    {
      "id": "role-assignment",
      "name": "Role assignment (User/Admin)",
      "operableBy": ["Admin"],
      "default": "User",
      "recommendedValue": "Least privilege: 'User' unless the person administers accounts; keep at least two Admins per agency",
      "implication": "An Admin can manage every account in the agency, including other Admins."
    },
    {
      "id": "account-enabled",
      "name": "Account enabled/disabled",
      "operableBy": ["Admin"],
      "default": "Enabled",
      "recommendedValue": "Disable immediately on departure or suspicion; delete only when the record should go",
      "implication": "Disabling blocks sign-in and revokes API access within seconds; reversible, preserves work attribution."
    },
    {
      "id": "delete-user",
      "name": "Delete user",
      "operableBy": ["Admin", "User (self only)"],
      "default": "n/a",
      "recommendedValue": "Disable first; delete when the record itself should be removed",
      "implication": "Irreversibly removes the sign-in identity, passkeys, profile, and the person's AI-assistant transcripts; published runs remain."
    },
    {
      "id": "user-email",
      "name": "User email address",
      "operableBy": ["Admin", "User (self only)"],
      "default": "Set at invite",
      "recommendedValue": "Government addresses the agency controls, always",
      "implication": "Email is the invite bootstrap and recovery anchor; changing it re-points account recovery."
    },
    {
      "id": "csc-cli",
      "name": "Agency SubsidyCLI (upload / replace / remove)",
      "operableBy": ["Admin"],
      "default": "Not uploaded; CSC runs refuse until it is",
      "recommendedValue": "Upload only the copy OMB issued to your agency; replace when OMB reissues it",
      "implication": "The binary carries the agency's OMB credential and is executed in the boundary for every CSC run; stored under the agency's own partition, never shared or served back; its hash is recorded on upload and verified before each run."
    },
    {
      "id": "passkeys",
      "name": "Passkeys (own account)",
      "operableBy": ["User", "Admin"],
      "default": "Enrollment required at first sign-in; user verification required",
      "recommendedValue": "At least two passkeys per account",
      "implication": "Removing the last passkey demotes sign-in to emailed one-time codes until a new passkey is enrolled."
    },
    {
      "id": "run-publish",
      "name": "Model run publish/unpublish",
      "operableBy": ["User", "Admin"],
      "default": "Draft (author-visible only)",
      "recommendedValue": "Publish only runs meant as the agency's official record",
      "implication": "The product's only visibility control; publishing exposes the run to the whole agency (never beyond it)."
    }
  ],
  "fixedPosture": [
    "Passwordless-only authentication (passkeys, user verification required); no passwords exist",
    "Mandatory passkey enrollment; email one-time codes only for invite/recovery bootstrap",
    "Server-side agency tenancy on every query and file path",
    "TLS in transit; KMS encryption at rest; uniform for every tenant",
    "Fixed session policy: 1-hour access tokens, 12-hour maximum session, server-side revocation",
    "No API keys, personal tokens, webhooks, or third-party integrations",
    "Invite-only; no self-registration"
  ],
  "providerOperated": [
    "Agency creation",
    "Assigning a user to a different agency",
    "Lytix staff (Super Admin) accounts",
    "Whole-agency deletion under the documented data-removal procedure"
  ],
  "contact": "security@lytix.xyz"
}