A classified document archive where every read is a token, and every token is logged.
The challenge
An institutional military archive has two kinds of reader — staff who work in it daily, and external authorised personnel who need one document, once. Giving the second group an account is a security problem; giving them nothing is an operations problem.
What we built
Outcomes
How we shipped it
Two doors, not one
Staff authenticate with credentials against the admin panel. External authorised personnel never get an account at all — an admin issues them a single-use or multi-use access token, and the visitor portal is the only thing that token opens. The two surfaces do not share a session model.
Read-only means read-only
The visitor viewer renders documents watermarked and without download, so the record of who saw what stays complete. Every token issue and every access is written to the audit log as its own event.
Classification as a first-class field
Access level and document format are part of the data model rather than a convention in a filename. That is what lets the dashboard count classified holdings accurately and what lets permissions be enforced at the query, not in the template.
Stack
Aprojectlikethis?
One-page brief, two-week sprint, real exit ramps.
next kickoff · week 34