SUIT - Security & Unified Identity Toolkit

Continuous Access Governance and Zero Standing Privileges infrastructure for Drupal 11.

Privilege is not a static property of an identity. If an administrative session is hijacked, or an account accumulates conflicting roles over time, treating access as permanent is fatal. This module enforces Just-In-Time (JIT) elevation, dynamic in-memory access calculation, separation of duties, and cryptographic audit logging without standing database permissions.

Privileged Identity Management (suit_pim)

Eliminates standing administrator roles in favor of bounded, Just-In-Time role elevations computed in volatile memory.

• Role eligibility, not assignment. Users are granted eligibility to request specific administrative roles rather than holding them permanently. An eligible user remains an unprivileged authenticated user until an active operational window is requested and approved.
• Memory-calculated dynamic access policy. Uses Drupal 11's AccessPolicyInterface (SuitAccessPolicy) to evaluate active elevations during request execution. Privileges are injected into volatile memory containers during the active grant window. The persistent user__roles database table is never mutated.
• Deterministic time-aware cache eviction. Calculated permissions are bound dynamically to the remaining grant window ($calculated_permissions->setCacheMaxAge($earliest_expiry)) and tagged with user-scoped cache tags (suit_elevation_user:{uid}). When an elevation expires, Drupal's permission cache evicts the entry the exact second the window closes.
• Fail-closed lifecycle. Because permissions exist only in volatile memory during the active grant window, privileges instantly cease the moment a lease expires. Background cron failures, queue stalls, or daemon crashes cannot cause privileges to persist.
• Approval workflows and change audit. Supports peer-reviewed or policy-based elevation queues with mandatory justification and change ticket references.

Separation of Duties & Identity Governance (suit_iam)

Automated governance preventing toxic role combinations and dormant account accumulation.

• Segregation of Duties (SoD) matrix. Enforces bidirectional toxic role constraints (e.g. Content Author + Content Publisher, or Billing Manager + Payment Approver) at the entity storage layer. Conflicting role assignments and conflicting JIT elevations are blocked unconditionally.
• Identity lifecycle states. Formalizes identity states (Active, Suspended, Locked, Dormant, Offboarded) with automated transition hooks.
• Dormancy detection. Scheduled engine identifies accounts exceeding inactivity thresholds (default 90 days), locks authentication access, and generates compliance records.

Privileged Access Management (suit_pam)

Execution-boundary verification and emergency break-glass controls.

• Execution-boundary step-up authentication. Guards sensitive configuration mutations (user_role, action, suit_role_eligibility) via hook_entity_access(). Headless REST and JSON:API requests without fresh step-up authentication receive standards-compliant RFC 7235 HTTP 401 Unauthorized challenges with WWW-Authenticate: SUIT-StepUp realm="Administrative Mutation".
• Privileged route shields. Intercepts critical administrative paths, enforcing re-authentication and idle timeouts for elevated sessions.
• Dual-custody break-glass console. Vaulted emergency procedure requiring dual-custody approval or emergency token verification for critical recovery.

Append-Only Cryptographic Audit Ledger

Tamper-evident security and compliance event logging (suit_audit_event).

• Cryptographic hash chain. Every audit event records a SHA-256 Merkle link (previous_hash and event_hash). The genesis event is cryptographically anchored to system.site:uuid.
• Immutable storage. Event entities reject any modification attempt with a fatal \LogicException at the preSave() boundary. Records cannot be edited or truncated from the administrative interface.
• Automated verification service. Recomputes historical chain integrity from genesis to detect any database tampering, row deletion, or retroactive manipulation.

What this module does not do

It does not replace Multi-Factor Authentication (MFA). SUIT governs what an authenticated identity is permitted to execute and when. Initial identity authentication should be secured via Two-Factor Authentication (TFA) or WebAuthn.

It does not manage external enterprise IdPs. Single Sign-On (SSO) and federation should be handled by SAML or OpenID Connect modules. SUIT enforces Continuous Access Governance natively inside Drupal's authorization engine once the identity is established.

It does not require external SaaS brokers. All elevation calculations, SoD validation, and hash-chain audit verifications run directly inside Drupal 11 with zero external vendor lock-in and zero third-party PHP dependencies.

Why not existing role and permission modules

Traditional Drupal privilege modules rely on static database assignment:

• Role Expire — Modifies persistent database tables (user__roles) and relies on background cron to delete expired rows. If cron fails or is delayed, administrative access persists indefinitely.
• Masquerade — Allows user switching for testing, but provides no time bounding, no justification tracking, no SoD conflict matrix, and no tamper-evident audit ledger.
• Static RBAC — Drupal core permissions assign permanent roles. A compromised administrator session gives an adversary indefinite, unconstrained access across the entire site.

Related

DPDP Compliance Toolkit provides statutory record-keeping for consent, purpose binding, Data Principal rights, and guardian authorizations under India's Digital Personal Data Protection Act, 2023.

Cyber Incident Register manages statutory incident reporting clocks under CERT-In, DPDP Rule 7, and GDPR Article 33.

Together, the three modules form a cohesive open-source compliance and security governance architecture for enterprise Drupal installations.

Requirements

Drupal 11. No third-party PHP libraries or external daemons required.

OpenSSF Best Practices: Project #16572 (100% Passing).

A note on the architecture

Drupal 11 introduced the AccessPolicyInterface to allow dynamic calculation of permissions outside the static role table. SUIT is built entirely on this foundation.

That architectural decision is critical: because permissions are injected dynamically into the CalculatedPermissions container in memory, there is no database record of the user having the administrative role. If the elevation window ends, or if an administrator revokes it, the cache is evicted immediately via setCacheMaxAge() and user cache tags. The next request executes with zero standing privileges, with no cleanup cron job ever required.

Disclosure

AI assisted in writing this module's code, tests and documentation.

It decided none of the substance. Every access policy calculation, cache max-age boundary, Segregation of Duties matrix, and SHA-256 hash chain was designed and verified by hand. Code quality adheres strictly to PHPStan Level 6, Drupal coding standards, and DrupalPractice. Automated Kernel tests verify access calculation and ledger immutability against a live Drupal 11 environment.