The platform ring.

DOCKET, VAULT, HELM and FORGE are registered as always_on platform fabric rather than separate sellable entitlements. That classification does not mean every role sees every surface or every target behavior is complete.

DOCKET — cases & investigations

DOCKET provides role-gated case and investigation surfaces. Alerts can create or reference cases where the source module and intake integration are configured. SLA, assignment, note history, attachments, escalation, reopening, QA and second-person approval are workflow-specific; do not infer append-only storage or universal automation from the UI.

The case lifecycle

VAULT — audit & evidence

VAULT provides role-gated audit, evidence, pack, grant and retention surfaces. Event coverage is not universal: verify which producer emitted actor, time, reason and correlation data. Hash chains, manifests, retention rules, legal holds, WORM storage and access-event recording apply only where implemented and configured; they cannot prove that an unrecorded event occurred.

HELM — platform administration

HELM provides role-gated administration surfaces for identity, tenants, entitlements, users, roles, branding, configuration and operations. Lockout, break-glass, cross-tenant switching, segregation of duties and their audit events depend on the configured service and role; verify each control before operational reliance.

FORGE — developer platform

FORGE provides role-gated developer surfaces for organizations, keys, sandbox, webhooks and limits. Sandbox Decision Records are demonstrations, not production-equivalent proof. SDK coverage, connector behavior, delivery logs, retries, redelivery and rate plans must be confirmed for the selected integration.