# 14 — Security Matrix (draft v0.1)

> **Status: draft for BA and security review (2026-10-30).** Derived from the use cases ([12-use-cases.md](12-use-cases.md)). Role codes are defined in [13-role-matrix.md](13-role-matrix.md). Cells marked [inferred] are our reading and need confirmation. Numeric values (limits, retention periods) are configured by the university and are not set here.

## 1. Data classification

| Level | Name | Examples | Baseline controls |
|---|---|---|---|
| **L1** | Public | Announcements, admission criteria and rubrics, curriculum, ITA/OIT data, degree-verification result (minimal fields) | Published deliberately; PII check before publishing (W-36) |
| **L2** | Internal | Timetables, course offerings, staff directory, aggregate statistics | Authenticated users |
| **L3** | Confidential | Student and applicant records, grades, attendance, finance and bank accounts, guardian relations, discipline, scholarships and กยศ., athlete performance and selection | Role + scope + relationship (ABAC); audit of changes |
| **L4** | Restricted (sensitive) | Health (`hlt_vault`), mental health, disability evidence, safeguarding cases, court orders and custody, whistleblower identity, national ID numbers | Need-to-know only; **every read audited**; break-glass with 2 approvers; never in notifications or bulk exports without DPO |

PDPA §26 sensitive data (health, disability, criminal records) is always L4.

## 2. Access by data domain and role

Legend: **C** create/submit · **R** read · **U** update/process · **A** approve/sign · **—** no access. Scope in brackets: `own`, `rel` (guardian relation), `sec` (sections taught), `adv` (advisees), `cls` (homeroom), `sq` (squad), `care`, `case` (assigned), `fac` (faculty), `camp` (campus/school), `all` (central).

### 2a. Learner-facing and academic domains

| Domain (level) | STUDENT | GUARDIAN | LECTURER / SS_TEACHER | ADVISOR / HOMEROOM | DEPT_HEAD / DEAN / SS_DIRECTOR | REGISTRAR | ADMISSIONS | Executives |
|---|---|---|---|---|---|---|---|---|
| Application and admission scores (L3) | CR own (APPLICANT); sees own per-station scores | R rel (minor applicant), consent | — | — | R/A fac (criteria, results) | R camp | CRU camp; override A (SoD-14) | R aggregate |
| Person profile and contact (L3) | R own; U via request | R rel | R sec (name, photo) | R adv/cls | R fac | CRU camp | R camp | aggregate only |
| National ID / passport (L4) | R own (masked) | — | — | — | — | R camp (unmasked for verification) | R camp (dedupe) | — |
| Guardian relations (L3) | R own; A observer consent (adult) | R own relation | — | R cls | A caregiver (SS_DIRECTOR) | CRU camp; verify level 1/2 | — | — |
| Student status and records (L3) | R own | R rel (per consent if adult) | — | R adv | A fac (withdrawal, LOA) | CRUA camp | — | R aggregate |
| Registration and timetable (L2/L3) | CRU own | R rel (per consent) | R sec | A adv (study plan, add/drop) | A fac (offering plan, overload) | U camp | — | R aggregate |
| Attendance (L3) | R own; C leave | R rel; C leave (minor) | CRU sec; A sick leave | R adv/cls | A มส. list (DEPT_HEAD) | R camp | — | R aggregate |
| Grades and scores (L3) | R own (after teaching evaluation) | R rel (minor; consent if adult) | CU sec until submitted, then locked | R adv | R distribution; A batch (DEAN); A (SS_DIRECTOR) | R; publish camp | — | R aggregate |
| Grade corrections (L3) | C appeal own | — | C request sec | — | A (requester ≠ approver, SoD-02) | U publish | — | — |
| Discipline cases (L3) | R own; respond | R rel (minor) | — | — | A sanction (DEAN) | R outcome for graduation | — | — |
| Accommodation plan (disability) (L3) / evidence (L4) | CR own | — | R **adjustments only**, no diagnosis | — | — | R plan (exam arrangements) | R plan (W-79) | — |
| Credentials and transcripts (L3) | C request own | — | — | — | — | CRUA camp | — | A sign (PRESIDENT) |
| Policy configuration (PolicySet, FeePolicy, MakeupPolicy) (L2) | — | — | U own course MakeupPolicy and assessment criteria [inferred] | — | A per chain | R/U draft | — | A (VP_FUNCTION, ACADEMIC_COUNCIL) |

### 2b. Services, finance, sports and welfare

| Domain (level) | STUDENT | GUARDIAN | FIN_OFFICER / FIN_HEAD | DORM_STAFF / STUDENT_AFFAIRS | COACH / SPORTS_HEAD | PHYSICIAN / NURSE / PHYSIO | SAFEGUARD_LEAD | Executives |
|---|---|---|---|---|---|---|---|---|
| Invoices and payments (L3) | R own; pay | R rel; pay via shareable link (OBSERVER needs consent for invoices) | CRU camp (maker/checker); A by limit (FIN_HEAD) | — | — | — | — | A above limit (CAMPUS_VP, PRESIDENT) |
| Bank / PromptPay account for refunds (L3) | U own with ThaID step-up | — | R camp; risky changes held 24 h after MFA reset | — | — | — | — | — |
| Scholarships and กยศ. (L3) | CR own | R rel (minor) | R camp | R volunteer-hour ledger | C certify status (SPORTS_HEAD) | — | — | A (CAMPUS_VP) |
| Dorm contract, room, leave pass, roll call (L3) | CR own | A leave pass (LEGAL or delegated CAREGIVER) | R deposit and fees | CRU dorm | R squad schedule [inferred] | — | R (case-related) | R aggregate |
| Court-order restrictions (L4) | — | C submit (custodial party) | — | R **the instruction only**, no case details | R instruction only | — | A restriction | — |
| Athlete profile, training, selection (L3) | R own | R rel | — | — | CRU sq; A selection (SPORTS_HEAD) | R readiness context | — | R aggregate |
| Competition leave (L3) | C own | R rel | R cash advance | — | C roster (COACH); C batch (SPORTS_HEAD) | — | — | A (DEAN for T3 / batch) |
| **Readiness status** FULL/MODIFIED/UNAVAILABLE (L3) | R own | R rel (minor) | — | R (dorm: temporary UNAVAILABLE) | **R sq without consent (D-05)** | CU care (UNAVAILABLE temporary for nurse) | — | — |
| **Clinical details**, injuries, concussion, medication (L4, `hlt_vault`) | R own; consent to share details | R rel (minor, per policy) | — | DORM_STAFF: C medication administered only | **R only with athlete consent** | CRU care | — | — |
| Health break-glass (L4) | — | — | — | — | — | C request; A (physician.lead ≠ requester) | — | A 2nd (DPO) |
| Mental-health records (L4) | R own | Informed: minors always, adults only if life-threatening | — | — | — | PSYCHOLOGIST: CRU care; ADVISOR gets study restrictions only with consent | — | — |
| Safeguarding cases (L4) | C report (anonymous allowed) | Informed unless involved | — | C report | C report; alleged persons **excluded** | C report | **CRUA case (assigned team only)** | A measures (CAMPUS_VP) |
| Complaints and whistleblowing (L3/L4) | C (anonymous allowed); R own via tracking code | — | — | — | — | — | (routed) | COMPLAINTS_CENTER: CRU; INTERNAL_AUDIT: R case |

Additional rules from the use cases:

- **Selection and retention decisions must not use health or psychology details**, only readiness status (W-150, W-151).
- **ATT, ASM and EXM receive practical restrictions without diagnosis** (W-39, W-33).
- **Alleged persons and their line managers are removed** from safeguarding case access. HOU, ATH and NOTI receive only the restriction they must enforce (W-22, W-93, W-155).
- Approving **sensitive roles** (health, safeguarding, finance approvers) needs certification by the `DATA_OWNER` during access recertification (W-126).

### 2c. Platform, governance and IT

| Domain (level) | DPO | DATA_OWNER | INTERNAL_AUDIT | IAM_ADMIN | SECURITY_ADMIN | PLATFORM_ADMIN / DBA / HELPDESK |
|---|---|---|---|---|---|---|
| Role assignments (L3) | R | A sensitive roles | R recertification report | CRU | R; A privileged | — |
| Audit log (L3/L4) | R | R own domain | R | — | R | — (cannot alter) |
| Consent records (L3) | R; handle requests | U own domain (execute requests) | R | — | — | — |
| Bulk personal-data export | A 2nd (sensitive) | A | R log | — | — | — |
| Production data change | — | A business approval | R log | — | A 2nd (asm/rec/fin) | C request (HELPDESK L2); review script (DBA). **No console edits** |
| Privileged / break-glass sessions | Review within 24 h (break-glass); breach assessment within 72 h | A when business data is touched | R | — | A 1st; review session recording | Request |

## 3. Authentication and session

| User group | Sign-in | Extra assurance | UC |
|---|---|---|---|
| Applicants | ThaID, or e-mail + OTP. National ID / passport / G-code as the dedupe key | — | W-41 |
| Students | SSO account created at reporting-in | MFA (W-142 exists for students); step-up with ThaID to change bank/PromptPay account and for PDPA requests | W-44, W-142, W-143, W-21 |
| Guardians | ID number + OTP (provisional: notifications and payment only) | Level 1 in-person or level 2 ThaID to get full guardian rights | W-127 |
| Alumni | Existing account or ThaID | ThaID for replacement documents | W-66, W-108 |
| Staff | SSO + **MFA** | MFA reset needs identity proofing + 2nd approver (`SECURITY_ADMIN` for sensitive roles) | W-142 |
| External (sponsored) | ThaID, or e-mail + OTP + documents; NDA/PDPA agreement | Account **expires**; included in recertification | W-139, W-126 |
| Judges on tablets | [unknown] | Scores lock after submission | W-76 |
| Employers verifying degrees | No login; QR/link | Rate limit, minimal fields, no name search | W-67 |

After an MFA reset, risky actions (e.g. changing the refund account) are **held for 24 hours** and all linked channels are notified (W-142).

## 4. Separation of duties (known rules)

| Rule | Constraint | UC |
|---|---|---|
| SoD-01 | A department head who teaches the course does not review its grades; it goes to a delegate | W-01 |
| SoD-02 | Requester ≠ approver for grade corrections | W-02 |
| SoD-05 | Fee-schedule setter ≠ approver | W-122 |
| SoD-06 | PolicySet editor ≠ publisher | W-15 |
| SoD-09 | Scholarship committee member ≠ the advisor who commented on the same application | W-07 |
| SoD-10 | Finance maker ≠ checker ≠ approver; approval by amount limit | W-81, W-102, W-120 |
| SoD-14 | Admission overrides need a reason and a separate approver [inferred] | W-74 |
| SoD-18 | Thesis-exam chair ≠ main advisor | W-95, W-159 |
| (unnumbered) | Cash-advance clearer ≠ advance approver; refund approver ≠ calculator; payer ≠ approver of account change; JIT requester ≠ approver; health break-glass approver ≠ requester; retention committee ≠ proposer; selection reviewer ≠ original selector | W-115, W-147, W-143, W-124, W-14, W-151, W-150 |

The full SoD list (SoD-01…18 and more) is in the team's Workflow book. Ask for it.

## 5. Privileged and emergency access

| Control | Rule | UC |
|---|---|---|
| JIT privileged access (PAM) | Ticket-backed, time-boxed credentials; session recorded; production writes always reviewed; asm/rec/fin schemas **read-only by default** | W-124 |
| Break-glass system account | Split credentials released by 2 approvers (`SECURITY_ADMIN`, CIO); SOC alerted; every command to WORM; review with DPO within 24 h; credentials rotated | W-125 |
| Data fixes | Through the pipeline only, with before/after in WORM and re-signed snapshots | W-137 |
| Access recertification | Periodic per-person review by line managers; uncertified access is revoked automatically | W-126 |
| Acting / delegation | Recorded, time-bound signing authority | W-123 |
| Staff working with children | `StaffClearance` with expiry; access to minors is suspended automatically when it expires | W-23, W-156 |

## 6. Audit and evidence

| Event | Requirement | UC |
|---|---|---|
| Reads of L4 data (health, safeguarding cases) | Logged per read; reviewed | W-14, W-22 |
| Status changes, approvals, role changes, consent changes | Audit log (AUD module) | W-127, W-128, W-133 |
| Approved grade sets, regulatory submissions | Signed snapshot (hash) + receipt | W-01, W-35 |
| Data fixes, break-glass commands | WORM storage | W-137, W-125 |
| Bulk exports | Watermark (who, when), expiring link, audit entry | W-138 |
| Emergency disclosure of contacts (vital interest) | Approver + audit | W-129 |

[inferred] Keep audit evidence separate from operational logs. OpenSearch is the centralised log store, but WORM evidence needs immutable storage (e.g. object lock on RustFS/S3). This is a decision to make, see [07-architecture-and-integrations.md](07-architecture-and-integrations.md).

## 7. Privacy rules that cut across modules

- **No PII in notification payloads** (LINE, e-mail, SMS) (W-36).
- National ID is masked in normal views [inferred]; full value only for verification roles.
- Consent records include purpose, version and expiry, and are revocable with immediate effect (W-128).
- Data-subject requests are checked against legal basis and `RetentionClass` before deletion (W-21).
- Degree verification shows minimal fields, is rate-limited and offers no name search (W-67).

## 8. Open points

1. Confirm the classification levels and the domain list.
2. MFA for students and guardians: required or optional?
3. Which roles may see unmasked national ID numbers?
4. Retention periods per `RetentionClass` (configured by the university).
5. Sports-school equivalents for university approvers (who replaces `DEAN`, `CAMPUS_VP` at a school?).
6. Whether committee members get their own accounts.