Add governed DSAR coverage for Audit evidence #9

New Issue

2026-08-21T04:09:42+02:00

zemion commented

2026-08-21 04:09:42 +02:00

Goal

Include subject-linked immutable Audit evidence in Core data-subject request access coverage, with retain-only erasure behavior, as tracked by GovOPlaN/govoplan#47.

Scope

provide and document privacy.dsar.audit
correlate exact tenant actor identifiers for audit records and platform-event envelopes
export minimized, redacted audit facts without arbitrary detail or event-payload scanning
include direct evidence-bundle request and replay-operator attribution
keep all Audit evidence retain-only and non-executable
exclude system/cross-tenant records from tenant requests
add bounded result handling, optional exact resource references, and Core workflow tests

Acceptance criteria

unrelated actors and tenants cannot be discovered
secrets, arbitrary details, event payloads, bundle payloads, and delivery errors are excluded
source/object references remain stable enough for authorized follow-up
every erasure plan is retain-only and execution reports blocked
conflicting aliases and foreign records/actions fail closed
focused tests, Ruff, and manifest checks pass

## Goal Include subject-linked immutable Audit evidence in Core data-subject request access coverage, with retain-only erasure behavior, as tracked by GovOPlaN/govoplan#47. ## Scope - provide and document `privacy.dsar.audit` - correlate exact tenant actor identifiers for audit records and platform-event envelopes - export minimized, redacted audit facts without arbitrary detail or event-payload scanning - include direct evidence-bundle request and replay-operator attribution - keep all Audit evidence retain-only and non-executable - exclude system/cross-tenant records from tenant requests - add bounded result handling, optional exact resource references, and Core workflow tests ## Acceptance criteria - unrelated actors and tenants cannot be discovered - secrets, arbitrary details, event payloads, bundle payloads, and delivery errors are excluded - source/object references remain stable enough for authorized follow-up - every erasure plan is retain-only and execution reports blocked - conflicting aliases and foreign records/actions fail closed - focused tests, Ruff, and manifest checks pass

zemion commented

2026-08-21 04:14:36 +02:00

Implemented and pushed in 869891f.

Audit now provides privacy.dsar.audit with exact tenant/actor correlation for audit records, structured platform-event envelopes, replay attribution, and evidence-bundle request attribution. Exports retain stable action/object/trace/policy/source/status references while excluding arbitrary details, event and bundle payloads, credentials, replay reasons, delivery keys, and errors. All actions are retain-only. Verification: 27 tests passed, Ruff passed, and the 68/68 manifest registry check passed.

Implemented and pushed in `869891f`. Audit now provides `privacy.dsar.audit` with exact tenant/actor correlation for audit records, structured platform-event envelopes, replay attribution, and evidence-bundle request attribution. Exports retain stable action/object/trace/policy/source/status references while excluding arbitrary details, event and bundle payloads, credentials, replay reasons, delivery keys, and errors. All actions are retain-only. Verification: 27 tests passed, Ruff passed, and the 68/68 manifest registry check passed.

zemion closed this issue

2026-08-21 04:14:37 +02:00

zemion referenced this issue from GovOPlaN/govoplan

2026-08-21 04:43:55 +02:00

[Privacy] Complete DSAR provider coverage across data-owning modules #47

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: GovOPlaN/govoplan-audit#9