---
path: /studio/isis/account-protection
surface: studio
domain: isis
auth:
  signed-in + studio entitlement (segment not in `AAA_ONLY_STUDIO_ROUTES` —
  renders as-is)
source: apps/oshun/web/src/app/studio/isis/account-protection/page.tsx
status: walked
last_walked:
  '2026-05-29 automated runtime walk (Playwright headless) — render, /v1 data
  (2xx), console/page-errors, expected content, screenshot verified; live
  screen-reader, touch, offline, and telemetry-delivery checks pending a manual
  AT pass. Evidence: WALKTHROUGH/results/runtime-sweep-2026-05-29.md; body
  re-derived 2026-06-03 from current source (lane-console architecture)'
---

# Isis Account Protection

## Purpose

Admin lane console that screens session/login events for account-takeover risk.
The workspace fetches previously-analyzed sessions and submits new ones to the
real anomaly-detection session analyzer, which raises signals for new devices
(+20), new locations (+25), and VPN/Tor usage (+15), then returns a risk score,
risk level, and recommended protective actions.

## Entry points

- Sibling quick-action card from `/studio/isis/cli-surface`
- Studio index (`/studio`)
- Direct URL / bookmark

## Layout regions

`page.tsx` mounts `ShellLayout active="studio"` and three panels (no breadcrumb
panel).

- **Workspace panel** (`data-isis-account-protection-workspace`): the
  `StudioIsisAccountProtectionWorkspace` lane console —
  - `<h1>` "Isis Account Protection Workspace" (`WorkspaceHeading`)
  - Summary paragraph (`data-account-summary`)
  - Aggregate band (`data-account-aggregate`) with `data-account-band={level}`
    chips and the analyzed-session count
  - The "Analyze a session" form (`data-account-form`)
  - Analyzed-session list (`data-account-sessions`) of `data-account-session`
    cards
- **Route map panel** (`data-isis-account-protection-route-map`): `<h2>` "Route
  Map" enumerating `STUDIO_ISIS_ACCOUNT_PROTECTION_ROUTE_MAP` (5 entries)
- **Quick-actions panel**: `quickAction` links to
  `/studio/isis/chargeback-prevention` and "Back to Studio workspace index" →
  `/studio`

## States

- [ ] **Loading** — `data-account-loading` "Loading analyzed sessions…" while the
      GET resolves
- [ ] **Unauthorized** — `data-account-unauthorized` (admin-scope fail-closed on
      401/403, "Isis workspace scope required to analyze account-protection
      sessions.")
- [ ] **Error** — `data-account-error` on non-OK / malformed response
- [ ] **Ready (form)** — aggregate + analyze form + session list render
- [ ] **Result** — `data-account-result` with `data-account-status` (`ok` /
      `error`), e.g. duplicate-session validation message

## Interactions

### Analyze a session (`data-account-form`)

- [ ] **Session id** — `data-account-sessionid` text input
- [ ] **User id** — `data-account-userid` text input
- [ ] **Event type** — `data-account-eventtype` text input (defaults `login`)
- [ ] **Device fingerprint (optional)** — `data-account-device` text input
- [ ] **Country (optional)** — `data-account-country` text input
- [ ] **VPN** — `data-account-vpn` checkbox
- [ ] **Tor** — `data-account-tor` checkbox
- [ ] **Analyze session** — `data-account-analyze` submit; POSTs to
      `/v1/admin/isis/account-protection`, then reloads the session list

### Route map

- [ ] **Route-map articles** ×5 — non-interactive path + purpose entries

### Quick-actions

- [ ] **Open Isis Chargeback Prevention workspace** →
      `/studio/isis/chargeback-prevention`
- [ ] **Back to Studio workspace index** → `/studio`

## Data & contracts

- **Reads**: `GET /v1/admin/isis/account-protection` (`ACCOUNT_ENDPOINT`) on
  mount — analyzed sessions + aggregate
- **Writes**: `POST /v1/admin/isis/account-protection` — screen a session
- **Realtime**: None
- **Caching**: client `fetch` on mount, `cache: 'no-store'`,
  `buildBffAuthHeaders()`
- **Auth**: admin-scoped fail-closed (401/403 → unauthorized state); route
  behind the signed-in + studio proxy gate
- **Component sources**:
  - `apps/oshun/web/src/components/studio/StudioIsisAccountProtectionWorkspace.tsx`
  - `apps/oshun/web/src/components/studio/StudioIsisAccountProtectionRouteMap.ts`

## Cross-references

- Studio overview: [`../../studio-overview.md`](../../studio-overview.md)
- Sibling routes:
  - [`studio-isis-chargeback-prevention.md`](./studio-isis-chargeback-prevention.md)
  - [`studio-isis-suspicious-activity-detection.md`](./studio-isis-suspicious-activity-detection.md)
  - [`studio-isis-cli-surface.md`](./studio-isis-cli-surface.md)

## Open questions / known gaps

- [ ] Route-map deep routes (`/scenes`, `/exports`, `/revisions`,
      `/governance`) are advertised contract paths, not yet implemented pages
- [ ] The session analyzer scores unknown users purely from session context —
      confirm how persistent per-user baselines are seeded in production