2.5 KiB
Parties And Representation Domain
Ownership
Parties owns procedure-local participation and representation authority. A Party references, but does not copy, an Identity, Organization, group, or external subject. It belongs to an exact case, workflow, or decision context.
Contact delivery uses frozen snapshot references so later address changes do not rewrite evidence. Preferred channels must be permitted by the procedure.
Unversioned reads follow the platform temporal-data context. An explicit procedure-resolution instant takes precedence over the titlebar valid-time choice. Recorded-time reconstruction remains separate from real-world validity, while permissions and new delivery actions use current state.
Representation
Representation powers identify representative and represented Parties, an external or internal power reference, permitted actions, effective time, and evidence. Existing powers cannot be removed or overwritten. They remain in the Party revision and are ended through an explicit, OCC-guarded revocation revision. Expired or revoked powers are not effective for downstream delivery.
Revision And Recovery
Party writes are append-only, replay-safe, tenant-bound, and protected by optimistic concurrency. The procedure identity cannot change across revisions. Database restore is the recovery unit; downstream effects preserve exact Party, contact-snapshot, and representation evidence references.
Data-subject requests
Parties publishes the privacy.dsar.parties capability. A search uses the exact
tenant plus a canonical identity, a supported account-backed external subject,
or an explicit parties.party/parties.revision reference. Combining a direct
reference with a conflicting canonical selector returns no data. The bounded
search exports typed party, procedure, channel, snapshot, and representation
facts. It never exports the raw JSON payload, free-text change reasons,
evidence identifiers, or unrelated counterpart party identifiers. An account
that only recorded a revision receives a separate, minimized attribution
record rather than the affected party's content.
Every stored revision and operator attribution is immutable accountability evidence and therefore receives a retention action. The current active party fact receives a non-executable manual-review action: an authorized operator must correct, expire, supersede, or explicitly revoke representation through the normal versioned lifecycle after reviewing procedural and third-party consequences. DSAR execution cannot mutate Parties data automatically.