[Privacy] Add governed Postbox DSAR coverage #28

New Issue

2026-08-21T00:17:42+02:00

zemion commented

2026-08-21 00:17:42 +02:00

Outcome

Postbox participates in the provider-neutral data-subject request workflow with bounded, tenant-isolated discovery and explicit retention or erasure dispositions for personal data in function-bound communication.

Scope

Cover personal data held in:

message participants and personally attributable message metadata;
personal read and acknowledgement receipts;
personal unified-inbox groupings;
access and lifecycle evidence attributed to accounts or identities;
configuration and protection-transition authorship where it identifies the subject.

Postbox messages and delivery, routing, acknowledgement, access, encryption-transition, and other institutional evidence remain governed records. The provider must not decrypt ciphertext, reveal wrapped keys or tokens, expose unrelated participants, copy opaque metadata, or bypass Postbox access and retention boundaries.

Acceptance criteria

Postbox publishes a versioned privacy.dsar.postbox capability through its manifest.
Search uses corroborated account, identity, membership, email, and namespaced Postbox references and fails closed on conflicting selectors.
Results are tenant-bounded, capped, deterministic, and contain only minimized data concerning the subject.
Plaintext message content is bounded and marked for manual privacy review; ciphertext, envelope/key material, external-recipient tokens, opaque metadata, and unrelated participant data are excluded.
Receipts, access events, delivery/routing evidence, and protection-transition evidence are retained with explicit reasons.
Personal grouping preferences receive an idempotent, revalidated erasure action that cannot delete source Postboxes or messages.
All other content/configuration changes are manual-review or retain actions; the provider does not silently change institutional records.
Execution rejects foreign, changed, cross-tenant, or no-longer-subject-owned actions and is idempotent.
Disabled-module and partial-failure behavior integrates with the Core DSAR workflow.
Static administrator documentation describes coverage, exclusions, retention, manual steps, and operational consequences.
Tests cover tenant isolation, selector conflicts, secret/ciphertext exclusion, unrelated-person exclusion, evidence retention, idempotent grouping deletion, stale actions, and inactive-provider coverage.
Postbox tests, manifest-shape checks, and the focused workspace gate pass.

Non-goals

Decrypting managed-envelope or E2EE content for DSAR discovery.
Automatically deleting institutional messages, delivery evidence, access evidence, or cryptographic transition history.
Treating Postbox as authoritative for Identity, IDM assignment, Files attachment, or producer-module records.

Parent umbrella: GovOPlaN/govoplan#47 ## Outcome Postbox participates in the provider-neutral data-subject request workflow with bounded, tenant-isolated discovery and explicit retention or erasure dispositions for personal data in function-bound communication. ## Scope Cover personal data held in: - message participants and personally attributable message metadata; - personal read and acknowledgement receipts; - personal unified-inbox groupings; - access and lifecycle evidence attributed to accounts or identities; - configuration and protection-transition authorship where it identifies the subject. Postbox messages and delivery, routing, acknowledgement, access, encryption-transition, and other institutional evidence remain governed records. The provider must not decrypt ciphertext, reveal wrapped keys or tokens, expose unrelated participants, copy opaque metadata, or bypass Postbox access and retention boundaries. ## Acceptance criteria - [x] Postbox publishes a versioned `privacy.dsar.postbox` capability through its manifest. - [x] Search uses corroborated account, identity, membership, email, and namespaced Postbox references and fails closed on conflicting selectors. - [x] Results are tenant-bounded, capped, deterministic, and contain only minimized data concerning the subject. - [x] Plaintext message content is bounded and marked for manual privacy review; ciphertext, envelope/key material, external-recipient tokens, opaque metadata, and unrelated participant data are excluded. - [x] Receipts, access events, delivery/routing evidence, and protection-transition evidence are retained with explicit reasons. - [x] Personal grouping preferences receive an idempotent, revalidated erasure action that cannot delete source Postboxes or messages. - [x] All other content/configuration changes are manual-review or retain actions; the provider does not silently change institutional records. - [x] Execution rejects foreign, changed, cross-tenant, or no-longer-subject-owned actions and is idempotent. - [x] Disabled-module and partial-failure behavior integrates with the Core DSAR workflow. - [x] Static administrator documentation describes coverage, exclusions, retention, manual steps, and operational consequences. - [x] Tests cover tenant isolation, selector conflicts, secret/ciphertext exclusion, unrelated-person exclusion, evidence retention, idempotent grouping deletion, stale actions, and inactive-provider coverage. - [x] Postbox tests, manifest-shape checks, and the focused workspace gate pass. ## Non-goals - Decrypting managed-envelope or E2EE content for DSAR discovery. - Automatically deleting institutional messages, delivery evidence, access evidence, or cryptographic transition history. - Treating Postbox as authoritative for Identity, IDM assignment, Files attachment, or producer-module records.

zemion added the

type

task

area/governance area/security module/postbox

codex/ready area/api labels 2026-08-21 00:17:43 +02:00

zemion commented

2026-08-21 00:52:08 +02:00

Implemented and pushed in e5da713 (feat(postbox): add governed DSAR coverage).

Delivered:

manifest-published privacy.dsar.postbox provider and capability documentation;
tenant-bounded, capped, fail-closed discovery across participants, messages, personal receipts/groupings, attributed access/configuration, and delivery/protection evidence;
ciphertext, envelope/key material, tokens, opaque metadata, unrelated participants, and cross-tenant data are excluded;
explicit retain/manual-review dispositions plus revalidated, idempotent deletion of personal groupings only;
static administrator documentation and comprehensive provider/Core integration tests.

Verification:

Postbox full suite: 59 passed;
manifest shapes: 68/68;
architecture manifests: 68/68;
information-governance check passed;
full tools/checks/check-focused.sh passed, including 59 WebUI permutations and 7 browser conformance tests.

The focused gate also exposed a pre-existing Mail package/manifest version mismatch from the preceding Mail DSAR slice; that was corrected and pushed separately as govoplan-mail@2fe56fc, with all 141 Mail tests passing.

Implemented and pushed in `e5da713` (`feat(postbox): add governed DSAR coverage`). Delivered: - manifest-published `privacy.dsar.postbox` provider and capability documentation; - tenant-bounded, capped, fail-closed discovery across participants, messages, personal receipts/groupings, attributed access/configuration, and delivery/protection evidence; - ciphertext, envelope/key material, tokens, opaque metadata, unrelated participants, and cross-tenant data are excluded; - explicit retain/manual-review dispositions plus revalidated, idempotent deletion of personal groupings only; - static administrator documentation and comprehensive provider/Core integration tests. Verification: - Postbox full suite: 59 passed; - manifest shapes: 68/68; - architecture manifests: 68/68; - information-governance check passed; - full `tools/checks/check-focused.sh` passed, including 59 WebUI permutations and 7 browser conformance tests. The focused gate also exposed a pre-existing Mail package/manifest version mismatch from the preceding Mail DSAR slice; that was corrected and pushed separately as `govoplan-mail@2fe56fc`, with all 141 Mail tests passing.

zemion closed this issue

2026-08-21 00:52:08 +02:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: GovOPlaN/govoplan-postbox#28