Policy authorization
Staff and portal access is decided by policies. Controllers do not branch on role names.
CrimeFire Network Operations Center
opsgrid is the enterprise desk for CrimeFire NOC: tasks, tickets, diagnostics, domains, and embeddable web labels — isolated by tenant, authorized by policy, and executed on the queue.
Staff and portal access is decided by policies. Controllers do not branch on role names.
Tenant secrets stay in encrypted storage. API responses mask everything but the last four characters.
Uptime, TLS, DNS, and site probes run on the queue. Hosts phone home — the desk never holds SSH keys.
Every client-scoped table carries a tenant. Global scopes enforce it; white-label brand rides the same boundary.
Platform
Purpose-built for a network operations center: multi-tenant, policy-gated, and safe to publish on a customer site.
Tasks, projects, and alerts on one board. Staff remain in the console; clients remain in their portal.
HTTP, TLS, DNS, mail, and site probes are scheduled work. Results feed scores, alerts, and labels.
Tickets, invoices, and plan-gated tools. A public reference plus the requester email is enough to track a case.
Registrar wallets, zone sync, and certificate reads through stored credentials — never through environment files.
Lobby and operations screens use scoped display tokens. Last-known-good remains on the device if the network drops.
Brand, users, and data stay inside the tenant. A custom domain or header selects the workspace.
Governance
The same record that operators use internally is what a client can embed or look up — without exposing the rest of the estate.
Monitors and toolkit scans collect posture. Open alerts and domain expiry sit on the same host record.
Scores grade A–F on a five-minute refresh. Staff rescore from the desk; stale embeds queue themselves.
A security or reputation badge publishes to the client site. The case tracker answers with status only.
Web labels
Clients embed an iframe or script. The badge polls JSON every 30 seconds. Portal users may label only hostnames already assigned to their account.
ogl_ · framed for third-party sitesissued hostname
Live score · queued refreshIllustrative mark. Production badges use the issued token.
Access
Staff enter the console. Clients use the portal. Anyone with a public reference can track a case.