feat: add governed Files DSAR coverage

2026-08-20 22:40:33 +02:00
parent 6c3cf1c55e
commit ce4eaefbfd
6 changed files with 1481 additions and 1 deletions
@@ -55,6 +55,15 @@ for example for managed attachment selection and campaign file sharing. Files
 does not import campaign internals; campaign share/existence checks use the core
 `campaigns.access` capability registered by the campaign module.

+Files also publishes the optional `privacy.dsar.files` capability. The Core
+data-subject workflow can use it to collect bounded, tenant-scoped file,
+version, share, folder, evidence, and non-secret configuration metadata for a
+direct membership subject. The provider may revoke a subject-targeted share or
+detach mutable actor references idempotently, but it never exports credential
+material or raw bytes and never bypasses Files retention, legal hold, evidence,
+purge approval, audit, or recovery controls. See the handbook's data-subject
+request coverage section for the review and erasure boundary.
+
 Platform RBAC and governance rules are documented in `govoplan-core/docs/`.

 Managed files can carry source provenance for connector and import workflows.