Using the product

Posture screens

The Index, Trust Graph, Counter-Factual, Risk Heatmap, Toxic Combinations, Credential Leaks, Issuance, Lineage, and the born-verified Agent Authority and Agent Trust screens.

The Posture group is where you see what identities exist, how they reach what, and where the real risk concentrates. Every surface is a pure read of your own scanned data — empty estates show honest empty states, and nothing is synthesized to fill a screen.

The Index

/identities · reads GET /api/identities

Your canonical identity register: every IAM role and discovered non-human identity TrustFix has seen, each with its class, real risk score, policy-scope count, open-finding count, and attestation-decay bar. Filter to Critical, AI agents, or Dormant; sort by risk, findings, scopes, or last-seen; open a row for detail and its findings. This is the single source of truth for what exists and what's hot.

Trust Graph

/trust-graph · reads GET /api/trust-graph and GET /api/toxic-combos

A visual map of who can reach what, built only from your scanned IAM roles and their trust policies. Identities, agents, KMS/secrets, and resources are nodes; edges are colored by effective risk, and toxic combinations are drawn as crimson dashed lines. Click a node to inspect it or jump into Counter-Factual to simulate a compromise from there.

Counter-Factual

/counter-factual · reads POST /api/trust-graph/blast-radius and GET /api/trust-graph/choke-points

A live blast-radius what-if. Pick an identity and TrustFix runs a real breadth-first reachability search across the trust graph, animating the breach hop by hop and counting how many nodes (and how many critical) it reaches. Cut an edge to re-run and see the real reduction, then push the chosen cut into the engine-verified Remediation Dry-Run. The Crown-Jewel Choke-Points table ranks the single edge whose removal severs the most paths to your crown jewels. Every hop and number is real reachability math; the optional exposure-$ overlay is explicitly labeled a model, not a measured loss.

Risk Heatmap

/risk-heatmap · reads GET /api/risk/heatmap

A prioritized risk-posture (ISPM) grid: every scored account and repo ranked by engine-derived composite risk, grouped by category and color-banded. Triage by surface rather than by individual alert, and click any cell to see its score and contributing findings. Empty cells stay empty; scores are never synthesized.

Toxic Combinations

/toxic-combinations · reads GET /api/toxic-combos (POST .../scan, GET .../predicted)

The deduplicated, risk-scored toxic combinations — and a "one finding away" panel flagging patterns one finding-type short of becoming critical.

Credential Leaks

/credential-risk · reads GET /api/credential-leaks

Per-credential leak profiles; a CONFIRMED LEAK badge only when a risk signal and an exposure signal share the same credential id.

Issuance

/issuance · reads GET /api/issuance/feed and GET /api/issuance/guard

Born-verified issuance: for every static secret discovered, the secretless replacement TrustFix can prove — badged dual-proven, proven, suggested·review, or rotated·not-secretless, never beyond what the math supports. The Issuance Guard refuses a mint that would complete a critical toxic-combo path.

Lineage

/lineage · reads GET /api/monitoring/alerts, /api/monitoring/metrics

The deep investigation surface for the monitoring engine. Every row is an Authority Event — an identity acting outside what it was verified to do — with a coverage line that states plainly how much of your estate is monitored against verified authority. Drill into /lineage/[seq] for the full story and the cryptographic proof you can verify yourself. Empty estates show an honest empty state; events are never fabricated to fill the feed.

Agent Authority — NEW

/agent-authority · reads GET /api/agent-passport, GET /api/mcp/baseline, GET /api/trust-receipt

The command center for born-verified agent identity over three signed primitives: signed Agent Passports (with an instant, provable revoke), the MCP supply-chain pin (a signed tool-drift baseline, OWASP ASI01), and a public Trust Receipt — a signed posture snapshot an auditor verifies at /trust-receipt/[id] with no tenant access.

Agent Trust — NEW

/agent-trust · reads GET /api/agent-trust

The ranked board for the per-agent trust score — a deterministic blend of signed authority, proven delegation narrowing, supply-chain integrity, and behavioral baseline. Coverage-honest: a signal with no data reads n/a, never 0.

Three more posture surfaces — Delegation Provenance, Attribution, and Agent Baselines — are currently PREVIEW. See the PREVIEW screens roadmap.