feat(cases): enforce purpose-bound case governance

2026-08-24 20:05:31 +02:00
parent 9435116299
commit 17415d8831
28 changed files with 786 additions and 142 deletions
@@ -34,17 +34,21 @@ The executable backend slice now exposes:
 Cases does not own institutional Service, Party, representation, identity,
 address, Mandate, Decision, file, workflow, or task lifecycles. The `/cases`
 workspace now supplies list/detail, status/title revision, history, and timeline
-surfaces. A case can remain tenant-visible or become restricted to its creator,
-case administrators, explicit user/group grants, and assignment-derived
-function, function-assignment, or organization-unit grants. The detail surface
-uses the shared reference selector to manage those grants; list, detail,
-history, timeline, and update paths all apply the same fail-closed ACL.
+surfaces. A case can remain tenant-visible or become restricted. Restricted
+access requires a current custodian, explicit subject, or assignment-derived
+grant whose permission and exact allowed purpose both match the operation.
+`cases.casework` is the interactive default and `cases.search` is reserved for
+Search rechecks. The detail surface uses the shared reference selector to
+manage grants and purposes; list, detail, history, timeline, update, evidence,
+Decision, Search, and Records-source paths apply the same fail-closed decision.
+Current grants also govern historical revision reads.

 See [docs/CONCEPT.md](docs/CONCEPT.md) for the current module concept.

 ## Data-subject requests

-Cases contributes `privacy.dsar.cases`. It reports exact-tenant access grants
+Cases contributes `privacy.dsar.cases`. It reports exact-tenant access grants,
+including their bounded allowed purposes,
 and operator attribution, plus minimized case lifecycle data when an explicit
 Cases reference is supplied and corroborated. Raw snapshots, metadata, search
 text, free-text reasons, event payloads, evidence identifiers, request digests,