Appendix
Glossary
| Term | Definition |
|---|
| AAL | Authenticator Assurance Level (NIST SP 800-63B). AAL2 = MFA-backed session. |
| Access grant | A time-bound assignment of a role to a user, recorded in access_grants. |
| Access review | Periodic attestation that an access grant is still warranted. |
| Audit log | Append-only record of governance and security events (access_audit_log). |
| Chapter | A single Markdown file in src/content/manual/chapters/ that contributes a section to the Project Manual. |
| Edge function | A Supabase function running on the Supabase Edge Runtime (Deno). |
| Evidence pack | A bundle of audit entries, approvals, and control results assembled for a regulator or auditor. |
| Manual | The Project Manual surfaced at /docs and exportable as PDF. |
| RBAC | Role-Based Access Control. |
| RLS | Row-Level Security (Postgres policies). |
| Server function | A typed RPC defined with createServerFn and called from the client. |
| Step-up | Promoting an aal1 session to aal2 by verifying a TOTP factor without re-enrolment. |
| Tenant | A logical isolation boundary in Regurai; every domain row is keyed by tenant_id. |
Acronyms
| Acronym | Expansion |
|---|
| ADR | Architectural Decision Record |
| AML | Anti-Money Laundering |
| BCP | Business Continuity Plan |
| CSP | Content Security Policy (HTTP header) or NCSC Cloud Security Principle (context-dependent) |
| DORA | Digital Operational Resilience Act (EU 2022/2554) |
| DPO | Data Protection Officer |
| DSAR | Data Subject Access Request |
| ERD | Entity-Relationship Diagram |
| GDPR | General Data Protection Regulation |
| GRC | Governance, Risk, and Compliance |
| HSTS | HTTP Strict Transport Security |
| MFA | Multi-Factor Authentication |
| MRM | Model Risk Management |
| NIST AI RMF | NIST Artificial Intelligence Risk Management Framework |
| OWASP | Open Worldwide Application Security Project |
| PITR | Point-In-Time Recovery |
| RTO / RPO | Recovery Time / Point Objective |
| SLA | Service Level Agreement |
| SSR | Server-Side Rendering |
| TOTP | Time-based One-Time Password (RFC 6238) |
References
External dependencies (runtime)
| Package | Purpose |
|---|
react, react-dom | UI runtime |
@tanstack/react-router, @tanstack/react-start, @tanstack/react-query | Routing, SSR, data |
@supabase/supabase-js | Auth + data client |
@react-pdf/renderer | Project Manual PDF generation |
react-markdown, remark-gfm | On-screen Markdown rendering |
qrcode | TOTP QR-code generation in the browser |
tailwindcss, tailwind-merge, clsx | Styling |
lucide-react | Icons |
zod | Input validation in server functions |
Bundled documentation files
| File | Purpose |
|---|
src/content/manual/README.md | Authoring contract for chapters |
src/content/manual/MANUAL_META.ts | Title, version, revisions |
src/content/manual/chapters/*.md | The manual itself |
docs/CHECKLIST.md | Definition of Done |
SECURITY.md (repo root) | Detailed regulatory control mapping |
Contact
For questions about this manual, contact the Platform team. For regulator-facing requests, route via the Compliance function.