govoplan-campaign/docs/ACCESS_EXPLANATION_COVERAGE.md

Campaign Access Explanation Coverage

Campaign access explanations are resource-specific evidence. They inherit the parent Campaign decision only where the child has no independent grant model, and they must identify that inheritance explicitly.

Implemented

• Campaign
• Campaign version
• Campaign delivery job / built message
• Computed Campaign report, identified by Campaign, version, and report kind
• Recipient row, identified by <version UUID>:<job UUID>
• Frozen recipient source snapshot, identified by its Campaign-version UUID
• Campaign attachment binding and version-bound frozen attachment resolution
• Persisted validation issue, version-bound review decision, and attachment-policy override
• SMTP, IMAP append, Postbox, and printable-output attempts
• Message action, message-action attempt, and job reconciliation decision

All persisted child IDs are random UUIDs. Embedded build/review children use a version UUID plus a random job UUID, so callers cannot enumerate a recipient index or infer an address. A version mismatch is reported as a stale reference. Missing and cross-tenant children use the same non-disclosing not-found provenance. Explanations never include recipient addresses, source rows, filenames, object locators, transport responses, worker claims, target snapshots, diagnostic text, or reconciliation notes.

Permission matrix

Evidence	Parent boundary	Further restriction
Recipient row or source snapshot	Campaign read/owner/share	campaigns:recipient:read
Attachment binding/resolution, validation, review, override	Campaign read/owner/share	Campaign review and campaigns:diagnostic:read
Delivery status	Campaign read/owner/share	campaigns:report:read
Transport or worker diagnostics	Campaign read/owner/share	campaigns:diagnostic:read
Exported delivery evidence	Campaign read/owner/share	campaigns:report:export
Reconciliation decision	Campaign read/owner/share	Campaign reconcile and diagnostic read

Postbox, Mail/IMAP, and printable attempts keep bounded Campaign-owned evidence after provider acceptance. Their explanation therefore remains available when an optional provider module is later disabled. A missing attempt reports only the optional owner and unavailable_or_hidden; it does not distinguish absence from hidden data.

Remaining owner boundaries

1. Campaign shares and ownership-transfer records
2. Import mapping profiles and import executions
3. Reusable Campaign templates and template revisions when the template library becomes persistent
4. Export packages and protocol/report artifacts

Each child explanation must include:

• the child resource identity and current state;
• the parent Campaign and version where applicable;
• whether access is inherited, independently granted, or further restricted;
• effective owner/share/policy provenance;
• missing-module or unavailable-evidence reasons without leaking the hidden object;
• a stable resource identifier suitable for audit and support links.

Delivery attempts, review decisions, reports, and exports can contain more sensitive evidence than the Campaign summary. Their read and diagnostic/export permissions therefore remain independently enforceable even when the parent Campaign is readable.