feat: govern reporting privacy and retention

2026-08-02 05:29:42 +02:00
parent 3aaa842ee6
commit 344e15dea4
6 changed files with 947 additions and 124 deletions
@@ -36,3 +36,11 @@ actions across system, tenant, group, and user scopes. Templates cannot run or
 be automated. Derived definitions retain ancestor ceilings, and every
 decision includes the ordered Policy source path and effective limits so a UI
 can explain why an action is available or blocked.
+
+Cross-module reports use `policy.reporting_governance`. System policy defines
+the export, retention, privacy-transform, and high re-identification-risk
+ceiling; tenant policy may only tighten it, and malformed explicit policy fails
+closed. The shared privacy-retention run calls the optional
+`reporting.retention` capability to clear expired provider-report payloads
+without importing Reporting models, while Reporting keeps hashes and bounded
+provenance as audit evidence.