Super Admin can set per-Client crypto policy

SHA-256 / AES-256-GCM is the baseline. SHA-1 stays legacy-only. Devices receive a signed policy package.

Cryptography is now a Super Admin policy on the Client record. New work uses SHA-256 or SHA-3 and AES-256-GCM. Anti-downgrade rejects SHA-1, AES-CBC, and AES-128 unless a legacy-migration exception is explicit.

Devices fetch the signed package or fall back to the same baseline. Offline Threat Handling fails closed when cryptoAccepted is false.

The 24-slide operator briefing and the CryptoEngine doc cover the control for CXO and security architecture reviews.

← Newsroom