From 8bdce810f24ab072d2cc7e97f6c2ccb1957a705d Mon Sep 17 00:00:00 2001 From: Albrecht Degering Date: Tue, 4 Aug 2026 14:02:03 +0200 Subject: [PATCH] Define governed forms runtime profiles --- docs/FORMS_RUNTIME_DOMAIN_BOUNDARY.md | 33 +++++++++++++++++++++++++-- 1 file changed, 31 insertions(+), 2 deletions(-) diff --git a/docs/FORMS_RUNTIME_DOMAIN_BOUNDARY.md b/docs/FORMS_RUNTIME_DOMAIN_BOUNDARY.md index 614abff..09622a0 100644 --- a/docs/FORMS_RUNTIME_DOMAIN_BOUNDARY.md +++ b/docs/FORMS_RUNTIME_DOMAIN_BOUNDARY.md @@ -71,6 +71,35 @@ stores only same-tenant evidence references. Cases and Workflow Engine retain their own target state; Runtime stores only a permitted same-tenant handoff reference and status evidence. +## Approved Intake And Evidence Profiles + +The product and security profile approved on 2026-08-04 sets the next +implementation boundary: + +- authenticated-account and invitation-token intake are the first public entry + profiles; +- anonymous intake is available only through an explicit per-form policy + opt-in, while a pseudonymous profile remains deferred; +- an anonymous submission cannot later be claimed by an identity; an invitation + submission can be linked only with explicit consent and proof of that + invitation; +- invitation tokens are hashed, tenant/form bound, replay safe, rate limited, + and expire after 14 days by default; +- drafts expire after 30 days by default, while every service/form must declare + submitted-data retention explicitly; and +- CAPTCHA remains an optional privacy-approved provider instead of a mandatory + external dependency. + +Files is the first attachment provider and retains byte storage, quarantine, +scanning, classification, retention, and legal-hold ownership. Runtime stores +only immutable same-tenant evidence references and must fail closed when a +required item is pending, rejected, expired, unavailable, or unverifiable. + +The first native signature profile is an authenticated acknowledgement. It is +not an advanced or qualified electronic signature. Those assurance levels +require a separately selected external trust-service provider and current +provider evidence; a required signature never silently degrades. + ## Recovery And Operations Database recovery restores identities, revisions, and events together. After @@ -84,8 +113,8 @@ Destructive retirement is blocked while state exists and requires a verified database snapshot plus an export or retention decision for referenced evidence. No local generated files are required, so API and worker nodes remain stateless. -Anonymous public intake and concrete file/signature upload adapters remain -product depth. Conditional multi-page definitions are resolved from Forms, and +The approved public-intake and concrete file/signature provider profiles remain +implementation depth. Conditional multi-page definitions are resolved from Forms, and native Case/Workflow handoffs execute automatically when the exact owner capability is installed. Additional target kinds remain adapter depth; the owner and security boundaries no longer depend on those additions.