Inspector Mode
For adminsInspector Mode
Section titled “Inspector Mode”Inspector Mode lets you give an external auditor, inspector or reviewer a window into Keystone that is read-only and time-limited, with every page they open recorded — so they can see the evidence for themselves without any risk of a change being made, and you keep a defensible record of what they looked at.
Find it under Admin → People & access → Inspector sessions (served at /admin/inspector-sessions).
Permission
Section titled “Permission”Granting and revoking sessions is gated on platform::inspector::manage, typically held by the trust admin or head of IT. Every grant and revoke writes a tamper-signed audit row.
Granting a session
Section titled “Granting a session”- Pick an existing Keystone user to be the inspector. They must already have an account — Inspector Mode doesn’t mint guest credentials, so your existing identity controls (SSO, MFA, password policy) still apply to them.
- Give the session a purpose — what the visit is for.
- Set an expiry. The session is active from the moment it’s granted until then.
What read-only means
Section titled “What read-only means”While a user has an active inspector session for the workspace:
- Every non-GET request is blocked with a 403 — defence in depth, so even if their role somehow carried a write permission, the action is still rejected at the HTTP layer.
- A banner is shown on every page, telling them that Inspector Mode is read-only and that the views they take are logged.
Sensitive-record views are captured in the access log as usual, so afterwards an admin can reconstruct exactly what the inspector saw and when.
Expiry and revocation
Section titled “Expiry and revocation”A session auto-releases at its expiry — no action needed. To end one early, revoke it, optionally recording a reason. A revoked session can’t be reactivated; grant a fresh one if access is needed again.