This document outlines the strict, chain-of-command-based hierarchy used within the SOCMINT.AI platform.
Platform Admin
│
Organization Admin
│
Case Supervisor
│
├── Investigator
├── OSINT Analyst
├── Digital Forensics Analyst
├── Auditor / Compliance Officer
└── Viewer / Executive
- Role Type: Infrastructure / System Wide
- Capabilities: Manages the entire platform instance, provisions organizations, monitors global system metrics, AI agent statuses, and infrastructure health.
- Restrictions: Should not be involved in day-to-day investigations.
- Role Type: Tenant Authority (e.g., State Police Department)
- Capabilities: Manages teams, users, permissions, and resources inside their specific organization. Can create units and invite supervisors/investigators.
- Restrictions: Can only access data related to their specific organization tenant.
- Role Type: Operational Head (e.g., Cyber Crime Inspector, Unit Head)
- Capabilities: Manages investigations and case workflows. Assigns work, approves reports, monitors investigators, and oversees the overall direction of cases within their unit.
- Role Type: Standard Field Agent / Primary Analyst
- Capabilities: The core user of the platform. Runs investigations, launches AI agents, reviews discovered profiles, runs image matching, analyzes relationships, and generates case reports.
- Role Type: Open-Source Intelligence Specialist
- Capabilities: Focuses on validating and enriching intelligence. Analyzes the public internet, social media, and open sources to provide context to investigator findings.
- Role Type: Hardware/Digital Evidence Specialist
- Capabilities: Analyzes digital evidence and metadata. Focuses on files, images, documents, and technical evidence. Operates the technical verification pipeline (e.g., hash generation, deep EXIF analysis).
- Role Type: Independent Oversight
- Capabilities: Ensures legality, integrity, and accountability. Monitors system usage, verifies evidence integrity (chain of custody), audits user access logs, and enforces compliance policies.
- Restrictions: Strictly Read-Only regarding case data. Has absolutely zero investigation powers.
- Role Type: Strategic Leadership (e.g., Commissioner, CISO)
- Capabilities: Monitors high-level metrics, reviews executive summaries, tracks department performance, and approves strategic decisions (like special case authorizations).
- Restrictions: Strictly Read-Only. Cannot conduct investigations, edit cases, or modify system data.
- Role-Based Access Control (RBAC): Every button, page, API route, and dashboard widget is controlled by permissions derived from this matrix.
- Evidence Locking: Once evidence passes the chain of approval, it is permanently locked and becomes Read Only. No edits are permitted.
- Audit Trails: Every action is logged and tracked by the
Auditorrole to ensure absolute chain of custody.
Good approach, Ravindra boss.
Let's start with the Platform Admin Dashboard (highest role).
Remember: Platform Admin should manage the platform, not investigations directly.
Organizations
Active Users
Active Cases
Investigations Today
AI Agent Runs
Reports Generated
Main module.
- Create Organization
- Edit Organization
- Suspend Organization
- Delete Organization
- View Organization Details
Organization Name
Organization Type
Contact Email
Phone
Address
Status
Created Date
Subscription Plan
Users Count
Cases Count
Reports Count
Storage Usage
Last Active
- View All Users
- Search User
- Suspend User
- Reset MFA
- Force Logout
- View Login History
Full Name
Email
Role
Organization
Status
Last Login
Created Date
Daily
Weekly
Monthly
Cases Created
Reports Generated
AI Runs
Most Active Organizations
Since your platform is AI-first.
Discovery Agent
Correlation Agent
Image Agent
Behavior Agent
Relationship Agent
Report Agent
Status
Response Time
Success Rate
Failed Runs
Total Executions
Enable Agent
Disable Agent
Restart Agent
Failed Logins
Suspicious Activity
Blocked Requests
Rate Limit Violations
IP Blacklist
IP Whitelist
Session Management
Token Revocation
Every action should be logged.
User Login
User Logout
Role Changes
Case Creation
Case Deletion
Organization Creation
Report Exports
Date
Organization
User
Action Type
Frontend
Node Backend
FastAPI Backend
MongoDB
Redis
Neo4j
MinIO
CPU Usage
Memory Usage
Storage Usage
Network Usage
New Organization
Failed Agent Runs
Security Alerts
High System Load
Suspicious Logins
Password Policy
MFA Policy
Session Timeout
Storage Limits
Report Retention
Dashboard
Organizations
Users
Analytics
AI Agents
Security
Audit Logs
Notifications
Settings
This is the complete Platform Admin Dashboard.
Next ask for Organization Admin Dashboard, and we'll design it in the same level of detail. Ravindra boss, Organization Admin is the most important operational role in the entire system.
Think of it as:
Tamil Nadu Cyber Crime Department
OR
Bangalore Cyber Cell
OR
Corporate Threat Intelligence Team
The Organization Admin manages people, teams, permissions, cases, and resources inside their organization.
Total Users
Active Investigations
Open Cases
Closed Cases
Reports Generated
AI Investigations Today
Storage Usage
Pending Approvals
Organization Name
Organization Type
Organization ID
Created Date
Status
Subscription Plan
Storage Allocated
Storage Used
Sidebar:
Teams
Create Team
Edit Team
Deactivate Team
Assign Supervisor
View Team Members
Cyber Investigation Unit
Threat Intelligence Unit
OSINT Research Unit
Digital Forensics Unit
This will be one of the biggest modules.
Columns
Name
Email
Role
Department
Status
Last Login
Created By
Create User
Invite User
Edit User
Suspend User
Activate User
Reset Password
Reset MFA
Force Logout
Transfer User
Form
Full Name
Official Email
Employee ID
Role
Department
Supervisor
Phone Number
Pending
Accepted
Expired
Rejected
Case Supervisor
Investigator
OSINT Analyst
Digital Forensics Analyst
Viewer
Auditor
Create Cases
View Cases
Edit Cases
Delete Cases
Approve Reports
Export Reports
Invite Users
Manage Teams
Open Cases
Under Review
Closed Cases
Archived Cases
Case ID
Case Name
Supervisor
Status
Priority
Created Date
View Case
Assign Team
Change Priority
Archive Case
Monitor all investigations running under the organization.
Running Investigations
Completed Investigations
Failed Investigations
Average Completion Time
Discovery Agent Running
Image Analysis Running
Report Generation Running
Monitor AI performance.
Identity Matches Found
Profiles Correlated
Images Processed
Reports Generated
Graphs Built
Discovery Agent
Correlation Agent
Visual Agent
Content Agent
Behavior Agent
Relationship Agent
Every critical action should require approval.
User Requests
Role Changes
Case Closures
Evidence Approval
Report Approval
Approve
Reject
Request Revision
Investigation Reports
Activity Reports
Security Reports
Audit Reports
PDF
CSV
JSON
Failed Logins
Locked Accounts
MFA Status
Inactive Users
Lock Account
Unlock Account
Force Password Reset
Force MFA Reset
User Created
User Deleted
Case Created
Role Updated
Evidence Exported
Report Downloaded
Date
User
Action
Department
New User Joined
Investigation Completed
Security Alert
Storage Threshold Reached
Failed Agent Execution
Cases By Department
Users By Role
Monthly Investigations
Investigation Success Rate
AI Usage Trend
Report Generation Trend
Organization Profile
Logo
Departments
Retention Policy
Notification Settings
Security Policies
Password Length
MFA Mandatory
Session Timeout
IP Restrictions
Download Restrictions
Dashboard
Teams
Users
Invitations
Roles & Permissions
Cases
Investigations
AI Intelligence
Approvals
Reports
Security
Audit Logs
Analytics
Notifications
Settings
This Organization Admin dashboard is effectively the control center of a cybercrime unit, managing people, investigations, security, approvals, and operational analytics while leaving actual investigation work to Supervisors, Investigators, and Analysts. Next role is the most important operational role:
This is usually:
Cyber Crime Inspector
Investigation Lead
Unit Head
Senior Officer
The supervisor manages investigations, assigns work, approves reports, and monitors investigators.
Active Cases
High Priority Cases
Cases Pending Review
Assigned Investigators
Investigations Running
Reports Awaiting Approval
Closed Cases
Average Resolution Time
Main module.
Case ID
Case Name
Priority
Status
Assigned Team
Created Date
Last Updated
Create Case
View Case
Assign Team
Change Priority
Close Case
Archive Case
Case Title
Case Description
Case Category
Priority
Department
Tags
Cyber Fraud
Social Media Abuse
Identity Theft
Online Harassment
Financial Scam
Threat Intelligence
OSINT Investigation
Custom
Assign resources to case.
Investigator
OSINT Analyst
Digital Forensics Analyst
Viewer
Add Member
Remove Member
Transfer Ownership
Set Lead Investigator
Monitor all active investigations.
Running Investigations
Completed Investigations
Failed Investigations
Pending Reviews
Discovery Agent
Correlation Agent
Visual Agent
Content Agent
Behavior Agent
Relationship Agent
Report Agent
One of the most important modules.
Matched Profiles
Confidence Score
Evidence Sources
Risk Level
Accept Match
Reject Match
Request Reanalysis
Add Notes
Username
Email
Phone
Profile URL
Screenshot
Image
Post
Document
Upload Evidence
Verify Evidence
Approve Evidence
Lock Evidence
Reports generated by investigators arrive here.
Report Name
Case
Created By
Status
Generated Date
Approve
Reject
Send Back
Export
Cases Assigned
Cases Completed
Investigations Run
Reports Submitted
Average Resolution Time
Top Investigators
Top Analysts
Most Active Users
Case activity timeline.
Case Created
Evidence Added
Agent Run Started
Agent Run Completed
Report Generated
Case Closed
Investigator Notes
Supervisor Notes
Case Comments
@Investigator
@Analyst
High Confidence Match
Suspicious Pattern Found
Investigation Failed
New Evidence Added
Report Awaiting Approval
Cases By Status
Cases By Priority
Investigation Duration
Match Confidence Distribution
Agent Success Rate
Dashboard
Cases
Investigations
Team Assignment
AI Findings
Evidence
Reports
Timeline
Analytics
Notifications
Settings
The key difference:
- Organization Admin manages people and departments.
- Case Supervisor manages investigations and case workflows.
- Investigator (next role) actually performs the SOCMINT investigation, launches AI agents, reviews discovered profiles, runs image matching, analyzes relationships, and generates reports. That's where most of the interesting screens will be. Now comes the Investigator Dashboard, which will be the most used screen in the entire platform.
This is where your AI-powered SOCMINT system actually shines.
My Active Cases
Investigations Running
Profiles Discovered
Identity Matches Found
Reports Generated
Pending Reviews
Completed Cases
Saved Searches
Case ID
Case Name
Priority
Status
Supervisor
Last Activity
Open Case
Continue Investigation
View Evidence
Generate Report
This is the primary feature.
Username
Email
Phone Number
Profile URL
Profile Image Upload
Quick Investigation
Full Investigation
Custom Investigation
When investigator clicks:
Start Investigation
The platform launches:
Discovery Agent
Correlation Agent
Visual Agent
Content Agent
Behavior Agent
Relationship Agent
Report Agent
Discovery Agent 100%
Correlation Agent 85%
Visual Agent 65%
Behavior Agent 40%
Relationship Agent 25%
Platform
Username
Profile URL
Confidence
Source
Instagram
GitHub
Twitter
Reddit
LinkedIn
Facebook
Telegram
Forums
View Profile
Add To Case
Compare
Ignore
This is one of the most important modules.
Profile A
Profile B
Confidence Score
Reasoning
Username Similarity
Bio Similarity
Image Similarity
Shared Links
Posting Similarity
Accept Match
Reject Match
Manual Review
Profile Picture
Screenshot
Image Evidence
Matching Profiles
Similarity Score
Platforms Found
Visual Evidence
Open Profile
Add Evidence
Compare Images
Technology
Finance
Politics
Gaming
Cryptocurrency
Keywords
Hashtags
Mentions
Links
Languages
Neutral
Positive
Negative
Aggressive
Promotional
Posting Frequency
Most Active Time
Most Active Day
Posting Consistency
Activity Gaps
Activity Heatmap
Posting Timeline
Platform Activity Comparison
Followers
Following
Mutual Connections
Mentioned Accounts
Communities
Interactive Relationship Graph
Expand Network
Filter Connections
Export Graph
Profiles
Posts
Images
URLs
Documents
Screenshots
Add Evidence
Tag Evidence
Verify Evidence
Link To Finding
Chronological investigation view.
Profile Discovered
Image Match Found
Relationship Found
Content Match Found
Report Generated
Private Notes
Case Notes
Observations
Recommendations
Rich Text
Tags
Mentions
Attachments
Quick Report
Investigation Report
Executive Summary
Evidence Report
PDF
DOCX
JSON
Investigation Completed
High Confidence Match
New Evidence Added
Supervisor Comment
Report Approved
Dashboard
My Cases
New Investigation
Investigations
Identity Discovery
Correlation Center
Image Analysis
Content Intelligence
Behavior Analysis
Relationship Intelligence
Evidence
Timeline
Reports
Notes
Notifications
This dashboard directly maps to the problem statement:
- Identifier collection
- Cross-platform correlation
- Reverse image analysis
- Behavioral analysis
- Content analysis
- Relationship analysis
- Reporting
The next role would be OSINT Analyst, which is different from Investigator because they focus on validating and enriching findings rather than conducting the full investigation workflow. Next role is:
The Investigator runs investigations.
The OSINT Analyst validates, enriches, verifies, and discovers additional intelligence.
Think:
Investigator
↓
Finds Accounts
OSINT Analyst
↓
Verifies Findings
Finds Additional Links
Builds Intelligence
Assigned Cases
Pending Validations
Profiles Verified
Intelligence Findings
Evidence Added
Relationships Discovered
Reports Contributed
Case ID
Case Name
Priority
Assigned Investigator
Status
Last Updated
Open Case
Review Findings
Add Intelligence
Validate Evidence
One of the most important modules.
Pending Correlations
Pending Image Matches
Pending Relationship Matches
Pending Profile Matches
Instagram ↔ Twitter
Confidence:
89%
Approve
Reject
Needs Review
Escalate
View discovered profiles.
Platform
Username
Bio
Profile URL
Followers
Following
Activity
Mark Relevant
Ignore
Add Notes
Link To Subject
Username Reuse
Variations
Aliases
Naming Patterns
ravindra07
ravindra_07
ravindras07
ravi07
Likely Identity Group
Profile Photo Comparison
Reverse Image Results
Image Similarity
Metadata Analysis
Approve Match
Reject Match
Request Manual Review
Keywords
Topics
Hashtags
Mentions
Links
Languages
Narrative Similarity
Cross Posting
Repeated Messages
Campaign Indicators
Groups
Communities
Forums
Channels
Interest Networks
Community Clusters
Shared Memberships
Common Interests
Mutual Connections
Frequently Mentioned Users
Repeated Interactions
Shared Followers
Subject
Connected Accounts
Communities
Influencers
Expand Network
Validate Connection
Flag Suspicious Link
Very important in real investigations.
Source URL
Collection Time
Collection Method
Confidence
Verification Status
Verified
Partially Verified
Unverified
Rejected
Observation
Assessment
Hypothesis
Recommendation
Subject appears to use the same
profile photo across multiple
platforms.
Analyst can add:
Additional Profiles
Additional Images
Additional Posts
Archived Links
External References
Profile Found
Profile Verified
Image Match Confirmed
Relationship Verified
Community Identified
Analysts don't usually finalize reports.
They contribute sections.
OSINT Findings
Identity Correlation
Community Analysis
Behavior Analysis
Recommendations
New Validation Request
Investigator Comment
Case Assigned
Evidence Rejected
Report Request
Dashboard
Assigned Cases
Validation Center
Profile Intelligence
Username Intelligence
Image Intelligence
Content Intelligence
Community Intelligence
Relationship Analysis
Source Verification
Evidence Enrichment
Timeline
Intelligence Notes
Report Contributions
Notifications
| Investigator | OSINT Analyst |
|---|---|
| Runs investigations | Verifies findings |
| Launches AI agents | Validates AI output |
| Generates reports | Contributes intelligence |
| Manages evidence | Enriches evidence |
| Owns case workflow | Owns intelligence quality |
After this, the next role would be Digital Forensics Analyst, which is quite different because they focus on device evidence, metadata, file analysis, and technical artifacts rather than social media intelligence.
This role is different from Investigator and OSINT Analyst.
The OSINT Analyst focuses on:
Public Internet
Social Media
Open Sources
The Digital Forensics Analyst focuses on:
Files
Images
Metadata
Documents
Technical Evidence
In your SOCMINT platform, this role can validate and analyze digital artifacts collected during investigations.
Assigned Cases
Evidence Items
Files Analyzed
Metadata Extracted
Hash Matches
Reports Submitted
Pending Reviews
Case ID
Case Name
Priority
Supervisor
Status
Evidence Count
Open Case
Analyze Evidence
Submit Findings
Main module.
Images
Videos
Documents
PDFs
Screenshots
Archives
Audio Files
Upload Evidence
Analyze
Generate Hash
Extract Metadata
Flag Evidence
Creation Date
Modified Date
GPS Data
Device Information
Software Used
Author Information
Image.jpg
Device:
iPhone 15
Location:
Chennai
Created:
2026-06-13
This can become a major differentiator.
EXIF Analysis
Reverse Image Match
Duplicate Detection
Manipulation Detection
Visual Similarity
Image Reused Across Platforms
Image Cropped
Metadata Removed
Possible Editing Detected
PDF Metadata
Word Metadata
Embedded URLs
Embedded Images
Hidden Text
Author
Creation Tool
Modification History
Extracted Links
MD5
SHA1
SHA256
Evidence Integrity
Duplicate Detection
Chain Of Custody
Original File
Hash Value
Verification Status
Build timeline from artifacts.
File Created
File Modified
Image Uploaded
Profile Updated
Document Shared
Chronological Evidence Timeline
Verified
Under Review
Rejected
Tampered
Approve
Reject
Request Reupload
Flag Suspicious
Link evidence to identities.
Image ↔ Account
Document ↔ Account
Metadata ↔ Location
Username ↔ Evidence
High
Medium
Low
Metadata Finding
Image Finding
Document Finding
Timeline Finding
Integrity Finding
Profile image reused across
3 platforms.
Confidence: High
Contributes forensic section to final report.
Evidence Integrity
Metadata Analysis
Image Analysis
Document Analysis
Technical Findings
New Evidence Uploaded
Evidence Requires Review
Case Assigned
Investigator Request
Supervisor Comment
Dashboard
Assigned Cases
Digital Evidence
Metadata Analysis
Image Forensics
Document Forensics
Hash Intelligence
Timeline Reconstruction
Evidence Verification
Technical Correlation
Findings
Report Contributions
Notifications
| Role | Primary Focus |
|---|---|
| Investigator | Runs investigations |
| OSINT Analyst | Verifies and enriches intelligence |
| Digital Forensics Analyst | Analyzes digital evidence and metadata |
The next role after this would be Auditor / Compliance Officer, whose job is not investigation but ensuring evidence integrity, legal compliance, access control, and accountability across the entire platform.
This role should have zero investigation powers.
Their purpose is:
Monitor
Verify
Audit
Enforce Compliance
Review Access
Ensure Evidence Integrity
In real cybercrime, intelligence, and government systems, auditors must remain independent.
Active Audits
Cases Reviewed
Evidence Reviews
Policy Violations
Access Violations
Pending Compliance Checks
Audit Reports Generated
Main module.
Evidence Compliance
Data Retention Compliance
User Access Compliance
Report Compliance
Investigation Compliance
Passed
Warning
Violation
Critical
One of the most important modules.
Login
Logout
Case Creation
Case Access
Evidence Upload
Evidence Download
Report Export
Role Change
Permission Change
User
Case
Department
Action
Date
User Name
Role
Department
Cases Accessed
Last Login
Failed Logins
Flag User
Request Review
Escalate
Ensure evidence hasn't been altered.
Evidence ID
Hash
Created Date
Modified Date
Verification Status
Hash Match
Chain of Custody
Modification Check
Valid
Modified
Corrupted
Unverified
Critical for legal admissibility.
Evidence Uploaded
Evidence Viewed
Evidence Modified
Evidence Approved
Evidence Exported
User
Timestamp
Action
IP Address
Who accessed what?
When?
How often?
Was it authorized?
Unauthorized Access
Mass Downloads
Excessive Exports
Unusual Activity
Case Creation
Case Assignment
Case Closure
Report Approval
Evidence Approval
Required Approvals Present
Evidence Verified
Sources Documented
Report Signed
Failed Logins
Account Lockouts
Permission Escalations
MFA Failures
Suspicious Sessions
Low
Medium
High
Critical
Password Policy
MFA Policy
Data Retention Policy
Evidence Retention Policy
Access Control Policy
Review
Recommend Changes
Flag Non-Compliance
User Activity Report
Access Audit Report
Evidence Integrity Report
Security Report
Case Compliance Report
PDF
CSV
JSON
Unauthorized Access
Evidence Tampering
Policy Breach
Improper Export
Missing Approval
Investigate
Escalate
Close
Mark False Positive
Critical Security Alert
Policy Violation
Evidence Integrity Failure
Unauthorized Access Attempt
Compliance Review Required
Dashboard
Compliance Center
Audit Logs
Access Reviews
Evidence Integrity
Chain Of Custody
Investigation Audits
Security Monitoring
Policy Management
Compliance Reports
Violations
Notifications
| Role | Goal |
|---|---|
| Investigator | Find evidence |
| OSINT Analyst | Validate intelligence |
| Digital Forensics Analyst | Analyze artifacts |
| Auditor / Compliance Officer | Ensure legality, integrity, accountability |
The next role would be Viewer / Read-Only Executive, typically department heads, commissioners, CISOs, or senior officials who need visibility into investigations but should not modify anything. This is usually the final operational role before returning to higher administrative roles.
This role is for:
Commissioner
Deputy Commissioner
Department Head
Director
CISO
Senior Management
Executive Leadership
These users should never conduct investigations.
Their job is:
Monitor
Review
Approve Strategic Decisions
Track Performance
View Outcomes
Total Active Cases
High Priority Cases
Critical Threats
Cases Closed This Month
Investigations In Progress
Reports Generated
Departments Active
Investigation Success Rate
This is the landing page.
Open Cases
Closed Cases
Escalated Cases
Average Resolution Time
Most Active Department
Most Common Threat Type
Monthly Cases
Threat Trends
Investigation Trends
Department Performance
Case ID
Case Name
Priority
Department
Supervisor
Status
Last Updated
View Case
View Summary
View Timeline
View Final Report
Cannot:
Edit Case
Delete Case
Assign Users
Provides high-level intelligence.
Identities Correlated
Communities Detected
Threat Networks Found
High Confidence Matches
Behavioral Anomalies
Identity Graph
Community Graph
Threat Heatmap
Cyber Fraud
Financial Scam
Identity Theft
Harassment
Fake Accounts
Threat Networks
Open
Under Investigation
Resolved
Department
Cases Handled
Cases Closed
Average Resolution Time
Success Rate
Investigators
Analysts
Forensics Staff
Active Cases
Cases By Month
Cases By Category
Cases By Region
Threat Growth Trend
Resolution Trend
Most Emerging Threat
Highest Risk Department
Investigation Bottlenecks
Resource Utilization
This will be heavily used.
Case Reports
Executive Summaries
Monthly Intelligence Reports
Threat Intelligence Reports
Compliance Reports
View
Download
Share
Print
If implemented.
Case Locations
Threat Clusters
Incident Density
Regional Trends
Date
Threat Type
Department
Executives may approve major actions.
Case Closure Approval
Special Investigation Approval
Resource Requests
Escalation Requests
Approve
Reject
Request Details
Read-only compliance monitoring.
Policy Violations
Access Violations
Evidence Issues
Pending Audits
Compliance Summary
Security Summary
Audit Summary
Critical Threat Detected
High Priority Case Created
Case Escalated
Major Report Published
Compliance Alert
Dashboard
Executive Summary
Cases
Intelligence Overview
Threat Intelligence
Department Performance
Strategic Analytics
Reports
Geographic Intelligence
Approvals
Compliance Overview
Notifications
Platform Admin
│
Organization Admin
│
Case Supervisor
│
├── Investigator
├── OSINT Analyst
├── Digital Forensics Analyst
├── Auditor / Compliance Officer
└── Viewer / Executive
At this point you've covered the complete operational hierarchy. The next thing I would design before any UI is the permission matrix (RBAC) because every button, page, API route, and dashboard widget should be controlled by permissions rather than role names. That becomes the backbone of the entire system.