Deliverables

flowchart LR
  subgraph t4["Restricted"]
    direction TB
    a1["Card PAN · health records<br/>government ID images"]
    a2["<i>controls:</i> tokenise at edge<br/>field encryption · CMK<br/>no non-prod copies<br/>access JIT + approved<br/>full audit"]
  end
  subgraph t3["Confidential"]
    direction TB
    b1["Personal data · salary<br/>contracts · pricing"]
    b2["<i>controls:</i> encrypt at rest + transit<br/>masked in non-prod<br/>RBAC + quarterly review<br/>DLP on egress"]
  end
  subgraph t2["Internal"]
    direction TB
    c1["Operational metrics<br/>internal docs"]
    c2["<i>controls:</i> authenticated access<br/>standard retention"]
  end
  subgraph t1["Public"]
    direction TB
    d1["Published pricing<br/>marketing content"]
    d2["<i>controls:</i> integrity only"]
  end

  t4 --> s1[("Core DB · EU · Restricted")]
  t3 --> s1
  t3 --> s2[("Warehouse · EU · Confidential")]
  t2 --> s2
  t2 --> s3[("Object store · Internal")]
  t1 --> s3

flowchart LR
  subgraph who["Identities"]
    direction TB
    dev(["Developers<br/><i>group</i>"])
    sre(["SRE<br/><i>group</i>"])
    aud(["Auditors<br/><i>group</i>"])
    wl["Workload Identity<br/><i>order-api</i>"]
    ci["Pipeline Identity<br/><i>deploy-prod</i>"]
  end

  subgraph roles["Roles"]
    direction TB
    r1["Reader<br/><i>standing</i>"]
    r2["Operator<br/><i>standing</i>"]
    r3["Break-Glass Admin<br/><i>JIT — 60 min, approved, logged</i>"]
    r4["Deployer<br/><i>pipeline only</i>"]
    r5["Data Reader — Masked<br/><i>no raw PII</i>"]
  end

  subgraph what["Resources"]
    direction TB
    a1["Prod Compute"]
    a2["Prod Data Store"]
    a3["Key Vault"]
    a4["Audit Logs<br/><i>append-only</i>"]
  end

  dev --> r1 --> a1
  dev --> r5 --> a2
  sre --> r2 --> a1
  sre --> r3
  r3 --> a1
  r3 --> a2
  aud --> r1 --> a4
  wl --> r5
  wl --> a3
  ci --> r4 --> a1