Email Security: document the raw-download budget and the access event - #380
Merged
Conversation
lcbill
previously approved these changes
Sep 5, 2026
maximelb
marked this pull request as ready for review
September 5, 2026 22:22
Contributor
Author
|
/lc-review |
lcbill
previously approved these changes
Sep 5, 2026
lcbill
previously approved these changes
Sep 5, 2026
Every call to the raw EML download — served or refused — now emits an EMAIL_ACTION with action: get_eml, and the route carries a per-key and a per-organization rate limit. Documents both, the refusal reason codes, and a D&R rule that alerts on download volume rather than on the fact that a download happened. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Contributor
Author
|
/lc-review |
maximelb
force-pushed
the
emlaudit/eml-access-record
branch
from
September 6, 2026 01:54
b9ce7cb to
7ebd7b1
Compare
lcbill
approved these changes
Sep 6, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Documents the two controls added to the raw-message download in the paired backend PRs.
api-reference.md— theGET /messages/{msg_uuid}/emlsection now states that every attempt, served or refused, emits anEMAIL_ACTIONwithaction: get_emlon the connection's sensor, carrying the actor, the message, the mailbox, the stated justification and the byte count. Adds the table ofrefused_reasoncodes a client can branch on, theauditedblock (includingevent_emitted, which isfalsewhen the organization has no live mail connection to ship on), and the two rate limits with the reason this is the only route on the surface that carries one.detections.md— a new "Watching the download itself" section with two working D&R rules: one alerting on download volume (the byte count is on the event precisely so the rule can be about volume rather than about the fact that one download happened, and the suppression block is what makes it quiet for normal use and loud for a scrape), and one alerting on the firstpermission_deniedrefusal, which is the earlier signal a stolen key produces. Template paths are.detect.event.…per the response-actions reference — the transform context is the detection, not the raw event.automation.md— one-line correction: theEMAIL_ACTIONrow said "on every remediation outcome", which is no longer the whole truth.Paired with legion_mailsec#79 (the record) and lc_api-go#935 (the budgets). Public repo — not merging; opened for review and for Maxime to merge when the backend is deployed.
🤖 Generated with Claude Code