Ironmark's compliance posture centers on audit — every state-changing action lands in an HMAC-chained log, roles are enforced at the API layer, and the audit chain is verifiable independent of the running instance.
Every mutating operation writes an audit row: who, what, when, from where, with what before/after state where applicable. Rows are chained by HMAC of the prior row's fields — a tampered row breaks the chain at the next verify pass. Verification runs on demand from the admin panel and produces a per-row disposition report.
Nine application roles — admin, author, qa, peer_review, cir_controller, graphics_editor, program_manager, customer, viewer — plus sysadmin as a separate capability for offline-update flows. A user has a primary role plus zero or more granted roles; project membership scopes what any role can actually reach. Endpoints check role at the API layer; the UI hides what a user can't reach but doesn't rely on UI hiding for the security boundary.
Granted roles aren't always-on — a user with author as their primary role and admin as a granted role has to explicitly elevate to admin, and the elevation is time-bounded. Request → confirm → window opens for a short interval → auto-expires. A countdown chip is visible in the UI throughout. Every action taken under elevation carries the elevation_event_id in the audit row, so a review can walk every action attributable to a given elevation window.
The compliance posture is uniform across deployments — there is no "DoD mode" vs "commercial mode" switch to configure. Peer-review self-guard is always enforced (an author cannot approve their own DM), audit chain is always HMAC-anchored, admin session state always lives in memory (see the callout below), and elevation is always time-bounded. Programs that need a stricter posture get it by tuning knobs that are visible to sysadmins (elevation window duration, audit-verify frequency, retention), not by flipping a hidden mode.
The audit chain export produces the artifact an auditor asks for without needing a live tour: every audit row in the requested window with the HMAC verification result inline, reproducible offline. Delivered as NDJSON. Access questions ("who could do what at time T") are answered by combining the audit rows in the window with the grants API for the users involved.