Internal controls engine and reporting of events generated by a network or associated applications

A tangible, non-transitory, machine-readable medium storing instructions that when executed by one or more processors effectuate operations comprising:

• obtaining, with one or more processors, with a network controller, a current state of a network, wherein:
• the network has a plurality of computing devices accessed by a plurality of users;
• the network is configured to provide network connectivity defined by a network graph;
• the network graph includes vertices corresponding to respective ones of the users or computing devices;
• the network graph includes edges between respective pairs of the vertices, each edge specifying permitted network communications between a pair of users or computing devices corresponding to the respective pair of vertices;
• and
• the network controller is operative to effectuate changes to the network based on the network graph by removing or adding permitted pair-wise connections between the users or computing devices;
• causing, with one or more processors, with the network controller, a graphical user interface to be presented that depicts at least part of the network graph and includes user-inputs by which a user requests changes to the network graph;
• receiving, with one or more processors, with the network controller, a request input via the graphical user interface to modify the network graph;
• and
• in response to the request, modifying, with one or more processors, with the network controller, the network graph and enforcing the modification, wherein at least one computing device among the plurality of computing devices of the network is configured to selectively forward packets through the network by performing operations comprising:
• receiving a first packet along a multi-hop route through the network, the first packet originating from a first one of the computing devices;
• accessing a first rule configured by a command from the network controller;
• determining based on the first rule to not forward the first packet to another one of the computing devices to which the first packet is addressed by a value in a header of the first packet, wherein the network graph does not indicate an edge between the first one of the computing devices and the another one of the computing devices to which the first packet is addressed;
• receiving a second packet along a multi-hop route through the network, the second packet originating from a second one of the computing devices;
• accessing a second rule configured by a command from the network controller;
• and
• determining based on the second rule to forward the second packet to another one of the computing devices to which the second packet is addressed by a value in a header of the second packet, wherein the network graph indicates an edge between the second one of the computing devices and the another one of the computing devices to which the second packet is addressed.