Demo mode — every action is simulated in-browser against a self-contained mock. Set NEXT_PUBLIC_API_BASE to point the same client at the live SS-26 / SS-01 / SS-10 APIs.

Security policies (UPO)

Write one versioned UnifiedPolicy, validate it fail-closed, and compile it to ZTNA / SD-WAN / firewall targets — apply with a reviewable diff (SS-26 UPO compiler).

corp-baseline → compiled targets

POST /upo/compile

ztna

allow sre → prod :443 (posture)
allow eng → corp :443
deny sales → prod
default deny *

sdwan

class prod floor 20% steer=latency
class corp floor 10% steer=loss
inspect crm → deep-inspect PoP

firewall

accept eng→corp/443
inspect any→crm (deep)
accept any→payments/443
drop sales→prod

Apply diff vs last-applied baseline

POST /upo/apply

+deny sales → prod
+inspect any → crm (deep)
−allow sales → prod (v3)
=12 rules unchanged