50 lines
2.5 KiB
Markdown
50 lines
2.5 KiB
Markdown
# Parties And Representation Domain
|
|
|
|
## Ownership
|
|
|
|
Parties owns procedure-local participation and representation authority. A
|
|
Party references, but does not copy, an Identity, Organization, group, or
|
|
external subject. It belongs to an exact case, workflow, or decision context.
|
|
|
|
Contact delivery uses frozen snapshot references so later address changes do
|
|
not rewrite evidence. Preferred channels must be permitted by the procedure.
|
|
|
|
Unversioned reads follow the platform temporal-data context. An explicit
|
|
procedure-resolution instant takes precedence over the titlebar valid-time
|
|
choice. Recorded-time reconstruction remains separate from real-world
|
|
validity, while permissions and new delivery actions use current state.
|
|
|
|
## Representation
|
|
|
|
Representation powers identify representative and represented Parties, an
|
|
external or internal power reference, permitted actions, effective time, and
|
|
evidence. Existing powers cannot be removed or overwritten. They remain in the
|
|
Party revision and are ended through an explicit, OCC-guarded revocation
|
|
revision. Expired or revoked powers are not effective for downstream delivery.
|
|
|
|
## Revision And Recovery
|
|
|
|
Party writes are append-only, replay-safe, tenant-bound, and protected by
|
|
optimistic concurrency. The procedure identity cannot change across revisions.
|
|
Database restore is the recovery unit; downstream effects preserve exact Party,
|
|
contact-snapshot, and representation evidence references.
|
|
|
|
## Data-subject requests
|
|
|
|
Parties publishes the `privacy.dsar.parties` capability. A search uses the exact
|
|
tenant plus a canonical identity, a supported account-backed external subject,
|
|
or an explicit `parties.party`/`parties.revision` reference. Combining a direct
|
|
reference with a conflicting canonical selector returns no data. The bounded
|
|
search exports typed party, procedure, channel, snapshot, and representation
|
|
facts. It never exports the raw JSON payload, free-text change reasons,
|
|
evidence identifiers, or unrelated counterpart party identifiers. An account
|
|
that only recorded a revision receives a separate, minimized attribution
|
|
record rather than the affected party's content.
|
|
|
|
Every stored revision and operator attribution is immutable accountability
|
|
evidence and therefore receives a retention action. The current active party
|
|
fact receives a non-executable manual-review action: an authorized operator
|
|
must correct, expire, supersede, or explicitly revoke representation through
|
|
the normal versioned lifecycle after reviewing procedural and third-party
|
|
consequences. DSAR execution cannot mutate Parties data automatically.
|