docs(risk-compliance): add German assurance guidance

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@govoplan/risk-compliance-webui",
-  "version": "0.1.15",
+  "version": "0.1.19",
   "private": true,
   "type": "module",
   "main": "webui/src/index.ts",
@@ -19,7 +19,7 @@
     "LICENSE"
   ],
   "peerDependencies": {
-    "@govoplan/core-webui": "^0.1.15",
+    "@govoplan/core-webui": "^0.1.18",
     "lucide-react": "^1.23.0",
     "react": ">=19.2.7 <20",
     "react-dom": ">=19.2.7 <20",

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "govoplan-risk-compliance"
-version = "0.1.15"
+version = "0.1.19"
 description = "GovOPlaN Risk Compliance platform module seed."
 readme = "README.md"
 requires-python = ">=3.12"
@@ -12,8 +12,8 @@ license = { file = "LICENSE" }
 authors = [{ name = "GovOPlaN" }]
 dependencies = [
   "defusedxml>=0.7.1",
-  "govoplan-core>=0.1.15",
+  "govoplan-core>=0.1.37",
-  "govoplan-access>=0.1.15",
+  "govoplan-access>=0.1.18",
 ]
 
 [tool.setuptools.packages.find]

src/govoplan_risk_compliance/backend/dsar_provider.py

@@ -0,0 +1,695 @@
+from __future__ import annotations
+
+import json
+from collections.abc import Mapping, Sequence
+from dataclasses import dataclass
+from datetime import datetime, timezone
+
+from sqlalchemy import or_
+from sqlalchemy.orm import Session
+
+from govoplan_core.core.dsar import (
+    DsarErasureActionRef,
+    DsarExecutionResultRef,
+    DsarRecordRef,
+    DsarSubjectRef,
+    dsar_capability_name,
+)
+from govoplan_risk_compliance.backend.db.models import (
+    RiskAssuranceEdge,
+    RiskAssuranceNode,
+    RiskSanctionsListSnapshot,
+    RiskScreeningCandidate,
+    RiskScreeningDisposition,
+    RiskScreeningException,
+    RiskScreeningRun,
+    RiskScreeningSubjectSnapshot,
+)
+
+
+RISK_COMPLIANCE_DSAR_CAPABILITY = dsar_capability_name("risk_compliance")
+_MAX_RECORDS = 5_000
+_MAX_SUBJECT_ITEMS = 100
+_MAX_SUBJECT_BYTES = 256 * 1024
+_CONFLICT = object()
+
+
+@dataclass(frozen=True, slots=True)
+class _SubjectSelectors:
+    account_id: str | None
+    membership_id: str | None
+    subject_ref: str | None
+    screening_id: str | None
+    assurance_node_id: str | None
+    assurance_edge_id: str | None
+
+    @property
+    def actor_ids(self) -> tuple[str, ...]:
+        return tuple(
+            dict.fromkeys(
+                value for value in (self.account_id, self.membership_id) if value
+            )
+        )
+
+    @property
+    def narrowed(self) -> bool:
+        return bool(
+            self.screening_id or self.assurance_node_id or self.assurance_edge_id
+        )
+
+
+class RiskComplianceDsarProvider:
+    provider_id = "risk_compliance"
+    module_id = "risk_compliance"
+
+    def search_subject(
+        self,
+        session: object,
+        *,
+        tenant_id: str,
+        subject: DsarSubjectRef,
+    ) -> Sequence[DsarRecordRef]:
+        db = _session(session)
+        selectors = _subject_selectors(subject)
+        if selectors is None:
+            return ()
+
+        records: list[DsarRecordRef] = []
+        if selectors.subject_ref and (not selectors.narrowed or selectors.screening_id):
+            query = (
+                db.query(RiskScreeningRun, RiskScreeningSubjectSnapshot)
+                .join(
+                    RiskScreeningSubjectSnapshot,
+                    RiskScreeningSubjectSnapshot.id
+                    == RiskScreeningRun.subject_snapshot_id,
+                )
+                .filter(
+                    RiskScreeningRun.tenant_id == tenant_id,
+                    RiskScreeningSubjectSnapshot.tenant_id == tenant_id,
+                    RiskScreeningSubjectSnapshot.subject_ref == selectors.subject_ref,
+                )
+            )
+            if selectors.screening_id:
+                query = query.filter(RiskScreeningRun.id == selectors.screening_id)
+            records.extend(
+                _subject_screening_record(run, snapshot)
+                for run, snapshot in _limited(
+                    query,
+                    RiskScreeningRun.started_at,
+                    RiskScreeningRun.id,
+                    label="subject screening",
+                )
+            )
+
+        actor_ids = selectors.actor_ids
+        if actor_ids and (not selectors.narrowed or selectors.screening_id):
+            run_query = (
+                db.query(RiskScreeningRun, RiskScreeningSubjectSnapshot)
+                .join(
+                    RiskScreeningSubjectSnapshot,
+                    RiskScreeningSubjectSnapshot.id
+                    == RiskScreeningRun.subject_snapshot_id,
+                )
+                .filter(
+                    RiskScreeningRun.tenant_id == tenant_id,
+                    RiskScreeningSubjectSnapshot.tenant_id == tenant_id,
+                    or_(
+                        RiskScreeningRun.created_by.in_(actor_ids),
+                        RiskScreeningSubjectSnapshot.submitted_by.in_(actor_ids),
+                    ),
+                )
+            )
+            if selectors.screening_id:
+                run_query = run_query.filter(
+                    RiskScreeningRun.id == selectors.screening_id
+                )
+            records.extend(
+                _screening_actor_record(run, snapshot, actor_ids)
+                for run, snapshot in _limited(
+                    run_query,
+                    RiskScreeningRun.started_at,
+                    RiskScreeningRun.id,
+                    label="screening actor attribution",
+                )
+            )
+
+            disposition_query = db.query(RiskScreeningDisposition).filter(
+                RiskScreeningDisposition.tenant_id == tenant_id,
+                or_(
+                    RiskScreeningDisposition.actor_account_id.in_(actor_ids),
+                    RiskScreeningDisposition.actor_membership_id.in_(actor_ids),
+                ),
+            )
+            if selectors.screening_id:
+                disposition_query = (
+                    db.query(RiskScreeningDisposition)
+                    .join(
+                        RiskScreeningCandidate,
+                        RiskScreeningCandidate.id
+                        == RiskScreeningDisposition.candidate_id,
+                    )
+                    .filter(
+                        RiskScreeningDisposition.tenant_id == tenant_id,
+                        RiskScreeningCandidate.run_id == selectors.screening_id,
+                        or_(
+                            RiskScreeningDisposition.actor_account_id.in_(actor_ids),
+                            RiskScreeningDisposition.actor_membership_id.in_(actor_ids),
+                        ),
+                    )
+                )
+            records.extend(
+                _disposition_actor_record(row)
+                for row in _limited(
+                    disposition_query,
+                    RiskScreeningDisposition.created_at,
+                    RiskScreeningDisposition.id,
+                    label="disposition attribution",
+                )
+            )
+
+        if actor_ids and not selectors.narrowed:
+            records.extend(self._unnarrowed_actor_records(db, tenant_id, actor_ids))
+
+        if actor_ids and selectors.assurance_node_id:
+            query = db.query(RiskAssuranceNode).filter(
+                RiskAssuranceNode.tenant_id == tenant_id,
+                RiskAssuranceNode.id == selectors.assurance_node_id,
+                RiskAssuranceNode.created_by.in_(actor_ids),
+            )
+            records.extend(
+                _assurance_node_actor_record(row)
+                for row in _limited(
+                    query,
+                    RiskAssuranceNode.recorded_at,
+                    RiskAssuranceNode.id,
+                    label="assurance-node attribution",
+                )
+            )
+
+        if actor_ids and selectors.assurance_edge_id:
+            query = db.query(RiskAssuranceEdge).filter(
+                RiskAssuranceEdge.tenant_id == tenant_id,
+                RiskAssuranceEdge.id == selectors.assurance_edge_id,
+                RiskAssuranceEdge.created_by.in_(actor_ids),
+            )
+            records.extend(
+                _assurance_edge_actor_record(row)
+                for row in _limited(
+                    query,
+                    RiskAssuranceEdge.recorded_at,
+                    RiskAssuranceEdge.id,
+                    label="assurance-edge attribution",
+                )
+            )
+
+        if len(records) > _MAX_RECORDS:
+            raise ValueError(
+                "Risk Compliance DSAR result limit exceeded; narrow selectors."
+            )
+        return tuple(
+            sorted(records, key=lambda item: (item.resource_type, item.resource_id))
+        )
+
+    @staticmethod
+    def _unnarrowed_actor_records(
+        db: Session,
+        tenant_id: str,
+        actor_ids: tuple[str, ...],
+    ) -> list[DsarRecordRef]:
+        records: list[DsarRecordRef] = []
+        imports = db.query(RiskSanctionsListSnapshot).filter(
+            RiskSanctionsListSnapshot.tenant_id == tenant_id,
+            RiskSanctionsListSnapshot.imported_by.in_(actor_ids),
+        )
+        records.extend(
+            _snapshot_import_actor_record(row)
+            for row in _limited(
+                imports,
+                RiskSanctionsListSnapshot.imported_at,
+                RiskSanctionsListSnapshot.id,
+                label="snapshot-import attribution",
+            )
+        )
+        exceptions = db.query(RiskScreeningException).filter(
+            RiskScreeningException.tenant_id == tenant_id,
+            RiskScreeningException.created_by.in_(actor_ids),
+        )
+        records.extend(
+            _exception_actor_record(row)
+            for row in _limited(
+                exceptions,
+                RiskScreeningException.created_at,
+                RiskScreeningException.id,
+                label="exception attribution",
+            )
+        )
+        nodes = db.query(RiskAssuranceNode).filter(
+            RiskAssuranceNode.tenant_id == tenant_id,
+            RiskAssuranceNode.created_by.in_(actor_ids),
+        )
+        records.extend(
+            _assurance_node_actor_record(row)
+            for row in _limited(
+                nodes,
+                RiskAssuranceNode.recorded_at,
+                RiskAssuranceNode.id,
+                label="assurance-node attribution",
+            )
+        )
+        edges = db.query(RiskAssuranceEdge).filter(
+            RiskAssuranceEdge.tenant_id == tenant_id,
+            RiskAssuranceEdge.created_by.in_(actor_ids),
+        )
+        records.extend(
+            _assurance_edge_actor_record(row)
+            for row in _limited(
+                edges,
+                RiskAssuranceEdge.recorded_at,
+                RiskAssuranceEdge.id,
+                label="assurance-edge attribution",
+            )
+        )
+        return records
+
+    def plan_erasure(
+        self,
+        session: object,
+        *,
+        tenant_id: str,
+        subject: DsarSubjectRef,
+        records: Sequence[DsarRecordRef],
+    ) -> Sequence[DsarErasureActionRef]:
+        del tenant_id
+        _session(session)
+        if _subject_selectors(subject) is None:
+            raise ValueError("Risk Compliance DSAR subject selectors conflict.")
+        actions: list[DsarErasureActionRef] = []
+        for record in records:
+            _validate_record(record)
+            actions.append(
+                DsarErasureActionRef(
+                    action_id=(
+                        f"risk_compliance:retain:{record.resource_type}:"
+                        f"{record.resource_id}"
+                    ),
+                    provider_id=self.provider_id,
+                    module_id=self.module_id,
+                    kind="retain",
+                    resource_type=record.resource_type,
+                    resource_id=record.resource_id,
+                    title=f"Retain {record.title}",
+                    rationale=(
+                        record.retention_reason
+                        or "Risk and compliance evidence remains immutable."
+                    ),
+                    executable=False,
+                )
+            )
+        return tuple(actions)
+
+    def execute_erasure(
+        self,
+        session: object,
+        *,
+        tenant_id: str,
+        subject: DsarSubjectRef,
+        actions: Sequence[DsarErasureActionRef],
+        request_id: str,
+    ) -> Sequence[DsarExecutionResultRef]:
+        del tenant_id
+        _session(session)
+        if _subject_selectors(subject) is None:
+            raise ValueError("Risk Compliance DSAR subject selectors conflict.")
+        results: list[DsarExecutionResultRef] = []
+        for action in actions:
+            _validate_action(action)
+            if action.executable or action.kind != "retain":
+                raise ValueError("Risk Compliance DSAR publishes retain actions only.")
+            results.append(
+                DsarExecutionResultRef(
+                    action_id=action.action_id,
+                    status="blocked",
+                    summary=(
+                        "Risk and compliance evidence remains unchanged under its "
+                        "legal, audit, and accountability obligations."
+                    ),
+                    evidence={"request_id": request_id},
+                )
+            )
+        return tuple(results)
+
+
+def _subject_selectors(subject: DsarSubjectRef) -> _SubjectSelectors | None:
+    references = subject.external_references
+    values = {
+        "account_id": _coalesce(
+            subject.account_id,
+            references.get("risk_compliance.account"),
+            references.get("access.account"),
+        ),
+        "membership_id": _coalesce(
+            subject.membership_id,
+            references.get("risk_compliance.membership"),
+            references.get("tenancy.membership"),
+        ),
+        "subject_ref": _coalesce(
+            references.get("risk_compliance.subject"),
+            references.get("risk_compliance.subject_ref"),
+        ),
+        "screening_id": _coalesce(
+            references.get("risk_compliance.screening"),
+            references.get("risk_compliance.screening_id"),
+        ),
+        "assurance_node_id": _coalesce(
+            references.get("risk_compliance.assurance_node"),
+            references.get("risk_compliance.assurance_node_id"),
+        ),
+        "assurance_edge_id": _coalesce(
+            references.get("risk_compliance.assurance_edge"),
+            references.get("risk_compliance.assurance_edge_id"),
+        ),
+    }
+    if any(value is _CONFLICT for value in values.values()):
+        return None
+    selectors = _SubjectSelectors(
+        account_id=_optional_string(values["account_id"]),
+        membership_id=_optional_string(values["membership_id"]),
+        subject_ref=_optional_string(values["subject_ref"]),
+        screening_id=_optional_string(values["screening_id"]),
+        assurance_node_id=_optional_string(values["assurance_node_id"]),
+        assurance_edge_id=_optional_string(values["assurance_edge_id"]),
+    )
+    if not selectors.actor_ids and not selectors.subject_ref:
+        return None
+    return selectors
+
+
+def _subject_screening_record(
+    run: RiskScreeningRun, snapshot: RiskScreeningSubjectSnapshot
+) -> DsarRecordRef:
+    data = {
+        "screening_id": run.id,
+        "subject_snapshot_id": snapshot.id,
+        "subject_ref": snapshot.subject_ref,
+        "subject_type": snapshot.subject_type,
+        "primary_name": (snapshot.primary_name or "")[:1_000] or None,
+        "aliases": _string_list(snapshot.aliases, 1_000),
+        "identifiers": _mapping_list(
+            snapshot.identifiers,
+            allowed=("type", "value"),
+            limits={"type": 100, "value": 1_000},
+        ),
+        "dates": _string_list(snapshot.dates, 100),
+        "addresses": _mapping_list(
+            snapshot.addresses,
+            allowed=("street", "city", "region", "postal_code", "country"),
+            limits={
+                "street": 1_000,
+                "city": 500,
+                "region": 500,
+                "postal_code": 100,
+                "country": 255,
+            },
+        ),
+        "status": run.status,
+        "outcome": run.outcome,
+        "candidate_count": run.candidate_count,
+        "started_at": _iso(run.started_at),
+        "completed_at": _iso(run.completed_at),
+    }
+    _bounded_json(data)
+    return _record(
+        resource_type="screening_subject_submission",
+        resource_id=run.id,
+        category="sanctions_screening_subject_data",
+        title="Sanctions screening subject submission",
+        data=data,
+        observed_at=run.completed_at or run.started_at,
+        retention_reason=(
+            "Version-pinned screening inputs and outcomes are retained as legal and "
+            "compliance evidence."
+        ),
+    )
+
+
+def _screening_actor_record(
+    run: RiskScreeningRun,
+    snapshot: RiskScreeningSubjectSnapshot,
+    actor_ids: tuple[str, ...],
+) -> DsarRecordRef:
+    activities = []
+    if run.created_by in actor_ids:
+        activities.append("created_screening")
+    if snapshot.submitted_by in actor_ids:
+        activities.append("submitted_screening_subject")
+    return _record(
+        resource_type="screening_actor_attribution",
+        resource_id=run.id,
+        category="risk_compliance_actor_attribution",
+        title="Screening actor attribution",
+        data={
+            "screening_id": run.id,
+            "status": run.status,
+            "outcome": run.outcome,
+            "candidate_count": run.candidate_count,
+            "activities": activities,
+            "started_at": _iso(run.started_at),
+            "completed_at": _iso(run.completed_at),
+        },
+        observed_at=run.completed_at or run.started_at,
+    )
+
+
+def _snapshot_import_actor_record(row: RiskSanctionsListSnapshot) -> DsarRecordRef:
+    return _record(
+        resource_type="snapshot_import_actor_attribution",
+        resource_id=row.id,
+        category="risk_compliance_actor_attribution",
+        title="Sanctions snapshot import attribution",
+        data={
+            "snapshot_id": row.id,
+            "provider_id": row.provider_id,
+            "source_id": row.source_id,
+            "source_version": row.source_version,
+            "status": row.status,
+            "entry_count": row.entry_count,
+            "activity": "imported_sanctions_snapshot",
+            "imported_at": _iso(row.imported_at),
+        },
+        observed_at=row.imported_at,
+    )
+
+
+def _disposition_actor_record(row: RiskScreeningDisposition) -> DsarRecordRef:
+    return _record(
+        resource_type="disposition_actor_attribution",
+        resource_id=row.id,
+        category="risk_compliance_actor_attribution",
+        title="Screening disposition actor attribution",
+        data={
+            "disposition_id": row.id,
+            "candidate_id": row.candidate_id,
+            "decision": row.decision,
+            "scope": row.scope,
+            "separation_status": row.separation_status,
+            "expires_at": _iso(row.expires_at),
+            "review_at": _iso(row.review_at),
+            "activity": "recorded_screening_disposition",
+            "created_at": _iso(row.created_at),
+        },
+        observed_at=row.created_at,
+    )
+
+
+def _exception_actor_record(row: RiskScreeningException) -> DsarRecordRef:
+    return _record(
+        resource_type="exception_actor_attribution",
+        resource_id=row.id,
+        category="risk_compliance_actor_attribution",
+        title="Screening exception actor attribution",
+        data={
+            "exception_id": row.id,
+            "scope": row.scope,
+            "status": row.status,
+            "starts_at": _iso(row.starts_at),
+            "expires_at": _iso(row.expires_at),
+            "review_at": _iso(row.review_at),
+            "activity": "created_screening_exception",
+        },
+        observed_at=row.created_at,
+    )
+
+
+def _assurance_node_actor_record(row: RiskAssuranceNode) -> DsarRecordRef:
+    return _record(
+        resource_type="assurance_node_actor_attribution",
+        resource_id=row.id,
+        category="risk_compliance_actor_attribution",
+        title="Assurance-object actor attribution",
+        data={
+            "assurance_node_id": row.id,
+            "stable_id": row.stable_id,
+            "kind": row.kind,
+            "revision": row.revision,
+            "state": row.state,
+            "valid_from": _iso(row.valid_from),
+            "valid_to": _iso(row.valid_to),
+            "recorded_at": _iso(row.recorded_at),
+            "superseded_at": _iso(row.superseded_at),
+            "activity": "created_assurance_object_revision",
+        },
+        observed_at=row.recorded_at,
+    )
+
+
+def _assurance_edge_actor_record(row: RiskAssuranceEdge) -> DsarRecordRef:
+    return _record(
+        resource_type="assurance_edge_actor_attribution",
+        resource_id=row.id,
+        category="risk_compliance_actor_attribution",
+        title="Assurance-relation actor attribution",
+        data={
+            "assurance_edge_id": row.id,
+            "stable_id": row.stable_id,
+            "revision": row.revision,
+            "relation": row.relation,
+            "state": row.state,
+            "valid_from": _iso(row.valid_from),
+            "valid_to": _iso(row.valid_to),
+            "recorded_at": _iso(row.recorded_at),
+            "superseded_at": _iso(row.superseded_at),
+            "activity": "created_assurance_relation_revision",
+        },
+        observed_at=row.recorded_at,
+    )
+
+
+def _record(
+    *,
+    resource_type: str,
+    resource_id: str,
+    category: str,
+    title: str,
+    data: Mapping[str, object],
+    observed_at: datetime | None,
+    retention_reason: str | None = None,
+) -> DsarRecordRef:
+    return DsarRecordRef(
+        provider_id="risk_compliance",
+        module_id="risk_compliance",
+        resource_type=resource_type,
+        resource_id=resource_id,
+        category=category,
+        title=title,
+        data=data,
+        observed_at=_aware(observed_at),
+        immutable_evidence=True,
+        retention_reason=(
+            retention_reason
+            or "Risk and compliance attribution is retained for legal, audit, and accountability evidence."
+        ),
+    )
+
+
+def _string_list(value: object, item_limit: int) -> list[str]:
+    if not isinstance(value, list) or len(value) > _MAX_SUBJECT_ITEMS:
+        raise ValueError("Risk Compliance DSAR subject list exceeds its bound.")
+    return [str(item)[:item_limit] for item in value]
+
+
+def _mapping_list(
+    value: object,
+    *,
+    allowed: tuple[str, ...],
+    limits: Mapping[str, int],
+) -> list[dict[str, str]]:
+    if not isinstance(value, list) or len(value) > _MAX_SUBJECT_ITEMS:
+        raise ValueError("Risk Compliance DSAR subject mapping list exceeds its bound.")
+    result: list[dict[str, str]] = []
+    for item in value:
+        if not isinstance(item, Mapping):
+            raise ValueError("Risk Compliance DSAR subject mapping is invalid.")
+        result.append(
+            {
+                key: str(item[key])[: limits[key]]
+                for key in allowed
+                if item.get(key) is not None
+            }
+        )
+    return result
+
+
+def _bounded_json(value: object) -> None:
+    try:
+        encoded = json.dumps(value, ensure_ascii=False, sort_keys=True).encode("utf-8")
+    except (TypeError, ValueError) as exc:
+        raise ValueError("Risk Compliance DSAR subject data is invalid.") from exc
+    if len(encoded) > _MAX_SUBJECT_BYTES:
+        raise ValueError("Risk Compliance DSAR subject data exceeds its byte bound.")
+
+
+def _limited(query, first, second, *, label: str):
+    rows = query.order_by(first, second).limit(_MAX_RECORDS + 1).all()
+    if len(rows) > _MAX_RECORDS:
+        raise ValueError(
+            f"Risk Compliance DSAR {label} limit exceeded; narrow selectors."
+        )
+    return rows
+
+
+def _coalesce(*values: str | None) -> str | None | object:
+    normalized = {str(value).strip() for value in values if str(value or "").strip()}
+    if len(normalized) > 1:
+        return _CONFLICT
+    return next(iter(normalized), None)
+
+
+def _optional_string(value: object) -> str | None:
+    return value if isinstance(value, str) and value else None
+
+
+def _iso(value: datetime | None) -> str | None:
+    aware = _aware(value)
+    return aware.isoformat() if aware else None
+
+
+def _aware(value: datetime | None) -> datetime | None:
+    if value is None or value.tzinfo is not None:
+        return value
+    return value.replace(tzinfo=timezone.utc)
+
+
+def _session(value: object) -> Session:
+    if not isinstance(value, Session):
+        raise TypeError("Risk Compliance DSAR requires a SQLAlchemy Session.")
+    return value
+
+
+_RESOURCE_TYPES = {
+    "screening_subject_submission",
+    "screening_actor_attribution",
+    "snapshot_import_actor_attribution",
+    "disposition_actor_attribution",
+    "exception_actor_attribution",
+    "assurance_node_actor_attribution",
+    "assurance_edge_actor_attribution",
+}
+
+
+def _validate_record(record: DsarRecordRef) -> None:
+    if record.provider_id != "risk_compliance" or record.module_id != "risk_compliance":
+        raise ValueError("Risk Compliance DSAR cannot plan a foreign provider record.")
+    if record.resource_type not in _RESOURCE_TYPES or not record.resource_id:
+        raise ValueError("Risk Compliance DSAR record identity is invalid.")
+
+
+def _validate_action(action: DsarErasureActionRef) -> None:
+    if action.provider_id != "risk_compliance" or action.module_id != "risk_compliance":
+        raise ValueError(
+            "Risk Compliance DSAR cannot execute a foreign provider action."
+        )
+    if not action.action_id.startswith("risk_compliance:retain:"):
+        raise ValueError("Risk Compliance DSAR action identity is invalid.")
+
+
+__all__ = ["RISK_COMPLIANCE_DSAR_CAPABILITY", "RiskComplianceDsarProvider"]

src/govoplan_risk_compliance/backend/manifest.py

@@ -11,6 +11,8 @@ from govoplan_core.core.module_guards import (
     persistent_table_uninstall_guard,
 )
 from govoplan_core.core.modules import (
+    CapabilityDocumentation,
+    DocumentationCondition,
     DocumentationLink,
     DocumentationTopic,
     FrontendModule,
@@ -21,6 +23,7 @@ from govoplan_core.core.modules import (
     ModuleManifest,
     NavItem,
     PermissionDefinition,
+    ProductAreaContribution,
     RoleTemplate,
 )
 from govoplan_core.core.sanctions import (
@@ -49,6 +52,10 @@ from govoplan_risk_compliance.backend.db.models import (
     RiskScreeningRun,
     RiskScreeningSubjectSnapshot,
 )
+from govoplan_risk_compliance.backend.dsar_provider import (
+    RISK_COMPLIANCE_DSAR_CAPABILITY,
+    RiskComplianceDsarProvider,
+)
 from govoplan_risk_compliance.backend.permissions import (
     ADMIN_SCOPE,
     READ_SCOPE,
@@ -62,7 +69,7 @@ from govoplan_risk_compliance.backend.permissions import (
 
 MODULE_ID = "risk_compliance"
 MODULE_NAME = "Risk Compliance"
-MODULE_VERSION = "0.1.15"
+MODULE_VERSION = "0.1.19"
 OPTIONAL_DEPENDENCIES = (
     "audit",
     "policy",
@@ -268,6 +275,10 @@ def _assurance_search_source(context):
     return create_risk_assurance_search_source(context)
 
 
+def _dsar_provider(_context) -> RiskComplianceDsarProvider:
+    return RiskComplianceDsarProvider()
+
+
 def _tenant_summary(session, tenant_id: str) -> dict[str, int]:
     return {
         "risk_sanctions_list_snapshots": (
@@ -304,10 +315,10 @@ def _tenant_summary(session, tenant_id: str) -> dict[str, int]:
 DOCUMENTATION = (
     DocumentationTopic(
         id=f"{MODULE_ID}.module-boundary",
-        title=f"{MODULE_NAME} module boundary",
+        title="Screen sanctions and manage assurance evidence",
         summary=(
-            "Risk and compliance workflows own legal evaluation, immutable "
+            "Run version-pinned sanctions screening and connect risks, controls, "
-            "screening evidence, review, and dispositions."
+            "evidence, findings, and corrective measures without automating legal conclusions."
         ),
         body=(
             "Connectors may acquire source evidence, but Risk Compliance "
@@ -326,6 +337,9 @@ DOCUMENTATION = (
             "module_admin",
             "compliance_reviewer",
         ),
+        conditions=(
+            DocumentationCondition(any_scopes=(READ_SCOPE, SANCTIONS_READ_SCOPE)),
+        ),
         order=100,
         related_modules=OPTIONAL_DEPENDENCIES,
         links=(
@@ -338,38 +352,43 @@ DOCUMENTATION = (
             ),
             DocumentationLink(
                 label="Interface pattern migration",
-                href=(
+                href=("govoplan-risk-compliance/docs/INTERFACE_PATTERN_MIGRATION.md"),
-                    "govoplan-risk-compliance/docs/INTERFACE_PATTERN_MIGRATION.md"
-                ),
                 kind="repository",
             ),
         ),
         metadata={
-            "domain_objects": [
+            "kind": "workflow",
-                "sanctions list snapshots",
+            "purpose": (
-                "screening runs",
+                "Produce reproducible screening and assurance evidence while keeping legal review explicit and human-accountable."
-                "candidate evidence",
-                "review dispositions",
-                "time-bounded exceptions",
-            ],
-            "privacy": (
-                "Queue and audit summaries contain stable references and "
-                "minimal subject data."
             ),
-            "assurance_domain_model": [
+            "prerequisites": [
-                "obligation",
+                "The actor can read the relevant assurance or sanctions area; import, screening, review, and editing use dedicated scopes.",
-                "governed object reference",
+                "A connector-provided source snapshot is available before sanctions-list import.",
-                "risk",
+                "The minimum necessary screening subject data and an exact governed subject reference are available.",
-                "control",
+            ],
-                "evidence",
+            "steps": [
-                "finding",
+                "Import connector evidence into an immutable normalized sanctions-list snapshot.",
-                "corrective measure",
+                "Run screening against one pinned snapshot using only the required subject data.",
-                "effectiveness review",
+                "Review every fuzzy candidate and record an evidence-backed disposition or time-bounded exception.",
+                "Create or revise assurance objects for obligations, risks, controls, evidence, findings, and corrective measures.",
+                "Connect assurance revisions through typed governed relationships and review effectiveness over time.",
+            ],
+            "fields": {
+                "source_snapshot": "An immutable normalized list revision with connector provenance and content fingerprint.",
+                "screening_run": "A version-pinned comparison of minimum subject data against one source snapshot.",
+                "candidate": "Potential matching evidence that requires human review and is never a confirmed match by itself.",
+                "disposition": "An append-only legal review outcome with reviewer, reason, evidence, and authority context.",
+                "exception": "A subject-and-entry decision bounded by explicit validity and expiry.",
+                "assurance_revision": "An effective-dated immutable revision of an obligation, risk, control, evidence, finding, measure, or review.",
+            },
+            "limitations": [
+                "Fuzzy matching only creates candidates and never confirms a sanctions match or legal prohibition.",
+                "Risk Compliance does not replace source acquisition, governed domain objects, Policy decisions, Audit evidence, or Records retention.",
+            ],
+            "privacy_notes": [
+                "Queue and audit summaries use stable references and the minimum necessary subject data.",
+                "Governed domain objects are linked through opaque references rather than copied into the assurance graph.",
             ],
-            "assurance_graph": (
-                "Every node and edge is effective-dated, revisioned, tenant-scoped, "
-                "and linked through opaque governed-object references."
-            ),
             "help_contexts": [
                 "risk_compliance.workspace",
                 "risk_compliance.sanctions.sources",
@@ -392,6 +411,77 @@ DOCUMENTATION = (
                 "revise_assurance_object": "append a new effective-dated revision while preserving prior evidence",
                 "connect_assurance_objects": "append a governed typed relationship between assurance objects",
             },
+            "verification": [
+                "Every screening result names the exact list snapshot, subject fingerprint, policy provenance, and run revision.",
+                "Every candidate remains pending until an authorized reviewer appends a disposition or exception.",
+                "Every assurance node and edge is tenant-scoped, effective-dated, revisioned, and linked by governed references.",
+            ],
+        },
+        translations={
+            "de": {
+                "title": "Sanktionsprüfung und Assurance-Nachweise steuern",
+                "summary": (
+                    "Versionsgebundene Sanktionsprüfungen durchführen und Risiken, Kontrollen, "
+                    "Nachweise, Feststellungen und Korrekturmaßnahmen verknüpfen, ohne rechtliche Schlüsse zu automatisieren."
+                ),
+                "body": (
+                    "Connectors können Quellnachweise beschaffen; Risk Compliance führt jedoch unveränderliche "
+                    "normalisierte Sanktionslisten, versionsgebundene Prüfungen, Kandidatenbewertungen und rechtliche "
+                    "Dispositionen. Unscharfer Abgleich erzeugt nur Kandidaten und bestätigt niemals einen Treffer. "
+                    "Die weitergehende Modulrichtung verknüpft Verpflichtungen, gesteuerte Objektreferenzen, Risiken, "
+                    "Kontrollen, Nachweise, Feststellungen, Korrekturmaßnahmen und Wirksamkeitsprüfungen, ohne das "
+                    "gesteuerte Fachobjekt zu kopieren oder Policy und Audit zu ersetzen."
+                ),
+            }
+        },
+        structured_translation_version="1",
+        structured_translations={
+            "de": {
+                "purpose": (
+                    "Reproduzierbare Prüf- und Assurance-Nachweise erzeugen und rechtliche Bewertung ausdrücklich und menschlich verantwortet halten."
+                ),
+                "prerequisites": [
+                    "Die handelnde Person darf den jeweiligen Assurance- oder Sanktionsbereich lesen; Import, Prüfung, Bewertung und Bearbeitung verwenden eigene Berechtigungen.",
+                    "Vor dem Import einer Sanktionsliste liegt ein von einem Connector bereitgestellter Quellsnapshot vor.",
+                    "Die minimal erforderlichen Betroffenendaten und eine exakte gesteuerte Betroffenenreferenz sind verfügbar.",
+                ],
+                "steps": [
+                    "Connector-Nachweise in einen unveränderlichen normalisierten Sanktionslistensnapshot importieren.",
+                    "Eine Prüfung mit nur den erforderlichen Betroffenendaten gegen genau einen fixierten Snapshot ausführen.",
+                    "Jeden unscharfen Kandidaten prüfen und eine nachweisgestützte Disposition oder befristete Ausnahme aufzeichnen.",
+                    "Assurance-Objekte für Verpflichtungen, Risiken, Kontrollen, Nachweise, Feststellungen und Korrekturmaßnahmen anlegen oder revidieren.",
+                    "Assurance-Revisionen durch typisierte gesteuerte Beziehungen verbinden und ihre Wirksamkeit im Zeitverlauf prüfen.",
+                ],
+                "fields": {
+                    "source_snapshot": "Eine unveränderliche normalisierte Listenrevision mit Connector-Provenienz und Inhaltsfingerabdruck.",
+                    "screening_run": "Ein versionsgebundener Vergleich minimaler Betroffenendaten mit genau einem Quellsnapshot.",
+                    "candidate": "Potenzieller Übereinstimmungsnachweis, der menschliche Prüfung erfordert und allein niemals ein bestätigter Treffer ist.",
+                    "disposition": "Ein nur anfügbares rechtliches Prüfungsergebnis mit prüfender Person, Begründung, Nachweis und Zuständigkeitskontext.",
+                    "exception": "Eine Entscheidung für Betroffenen- und Listeneintrag mit ausdrücklicher Gültigkeit und Ablaufzeit.",
+                    "assurance_revision": "Eine zeitlich wirksame unveränderliche Revision von Verpflichtung, Risiko, Kontrolle, Nachweis, Feststellung, Maßnahme oder Prüfung.",
+                },
+                "limitations": [
+                    "Unscharfer Abgleich erzeugt nur Kandidaten und bestätigt niemals einen Sanktionstreffer oder ein rechtliches Verbot.",
+                    "Risk Compliance ersetzt weder Quellenbeschaffung noch gesteuerte Fachobjekte, Policy-Entscheidungen, Audit-Nachweise oder Records-Aufbewahrung.",
+                ],
+                "privacy_notes": [
+                    "Warteschlangen- und Auditübersichten verwenden stabile Referenzen und die minimal erforderlichen Betroffenendaten.",
+                    "Gesteuerte Fachobjekte werden über opake Referenzen verknüpft und nicht in den Assurance-Graphen kopiert.",
+                ],
+                "consequence_classes": {
+                    "import_snapshot": "Kopiert Connector-Nachweise in einen unveränderlichen normalisierten Sanktionslistensnapshot.",
+                    "run_screening": "Erzeugt unveränderliche versionsgebundene Prüfnachweise aus den minimal erforderlichen Betroffenendaten.",
+                    "record_disposition": "Fügt eine nachweisgestützte rechtliche Disposition an, die nicht an Ort und Stelle bearbeitet wird.",
+                    "record_exception": "Fügt eine befristete Ausnahme für Betroffenen- und Listeneintrag mit ausdrücklichem Ablauf an.",
+                    "revise_assurance_object": "Fügt eine neue zeitlich wirksame Revision an und bewahrt frühere Nachweise.",
+                    "connect_assurance_objects": "Fügt eine gesteuerte typisierte Beziehung zwischen Assurance-Objekten an.",
+                },
+                "verification": [
+                    "Jedes Prüfergebnis nennt exakten Listensnapshot, Betroffenenfingerabdruck, Richtlinienherkunft und Ausführungsrevision.",
+                    "Jeder Kandidat bleibt offen, bis eine befugte prüfende Person eine Disposition oder Ausnahme anfügt.",
+                    "Jeder Assurance-Knoten und jede Kante ist mandantenbegrenzt, zeitlich wirksam, revisioniert und durch gesteuerte Referenzen verknüpft.",
+                ],
+            }
         },
     ),
 )
@@ -411,6 +501,10 @@ manifest = ModuleManifest(
             name="risk_compliance.sanctions_screening",
             version="1.0.0",
         ),
+        ModuleInterfaceProvider(
+            name=RISK_COMPLIANCE_DSAR_CAPABILITY,
+            version="0.1.0",
+        ),
     ),
     requires_interfaces=(
         ModuleInterfaceRequirement(
@@ -425,6 +519,17 @@ manifest = ModuleManifest(
     route_factory=_route_factory,
     capability_factories={
         CAPABILITY_RISK_COMPLIANCE_SANCTIONS_SCREENING: (_sanctions_screening_provider),
+        RISK_COMPLIANCE_DSAR_CAPABILITY: _dsar_provider,
+    },
+    capability_documentation={
+        RISK_COMPLIANCE_DSAR_CAPABILITY: CapabilityDocumentation(
+            label="Risk Compliance data-subject request provider",
+            summary=(
+                "Exports verified screening-subject data and minimized compliance "
+                "attribution while protecting third-party and legal-review evidence."
+            ),
+            contract_version="0.1.0",
+        ),
     },
     search_sources=(
         SearchSourceProviderRegistration(
@@ -454,6 +559,17 @@ manifest = ModuleManifest(
                 surface_id="risk_compliance.navigation",
             ),
         ),
+        product_areas=(
+            ProductAreaContribution(
+                id="data-assurance",
+                module_id=MODULE_ID,
+                label="i18n:govoplan-core.product_area.data_assurance",
+                icon="database-zap",
+                description="i18n:govoplan-core.product_area.data_assurance_description",
+                surface_ids=("risk_compliance.navigation", "risk_compliance.workspace"),
+                order=60,
+            ),
+        ),
         view_surfaces=(
             ViewSurface(
                 id="risk_compliance.sanctions.sources",
@@ -553,7 +669,91 @@ manifest = ModuleManifest(
             label="Risk Compliance",
         ),
     ),
-    documentation=DOCUMENTATION,
+    documentation=(
+        DocumentationTopic(
+            id="risk_compliance.data-subject-requests",
+            title="Risk and compliance data-subject requests",
+            summary=(
+                "Export verified screening-subject data and accountable activity "
+                "without disclosing third-party sanctions or review evidence."
+            ),
+            body=(
+                "Risk Compliance correlates screening subject data only through an "
+                "exact, separately verified subject reference. An account or membership "
+                "identifier independently locates the subject's own operator, reviewer, "
+                "import, exception, and assurance-graph attribution. Searches can narrow "
+                "to a screening or assurance revision, but an object identifier alone "
+                "never establishes identity. Subject exports include bounded submitted "
+                "names, aliases, identifiers, dates, addresses, and the screening "
+                "lifecycle outcome. They exclude sanctions-entry data about third "
+                "parties, candidate matching evidence, fingerprints, hashes, policy "
+                "snapshots, reviewer reasons, authority context, provenance, and evidence "
+                "references. Version-pinned screenings, dispositions, exceptions, and "
+                "assurance revisions remain retained legal and accountability evidence."
+            ),
+            layer="configured",
+            documentation_types=("admin", "user"),
+            audience=("user", "operator", "module_admin", "auditor"),
+            related_modules=("core", "access", "audit", "records", "policy"),
+            order=90,
+            metadata={
+                "kind": "reference",
+                "help_contexts": [
+                    "risk_compliance.sanctions.screening",
+                    "privacy.data-subject-requests",
+                ],
+                "consequence_classes": {
+                    "export_screening_subject": (
+                        "Returns bounded subject input and lifecycle data for an exact reference."
+                    ),
+                    "exclude_third_party_evidence": (
+                        "Never returns sanctions entries, match evidence, or protected review payloads."
+                    ),
+                    "retain_compliance_evidence": (
+                        "Preserves version-pinned legal, audit, and accountability history."
+                    ),
+                },
+            },
+            translations={
+                "de": {
+                    "title": "Datenschutzanfragen zu Risiko und Compliance",
+                    "summary": (
+                        "Verifizierte Daten geprüfter Betroffener und verantwortbare Aktivitäten exportieren, "
+                        "ohne Sanktions- oder Prüfungsnachweise Dritter offenzulegen."
+                    ),
+                    "body": (
+                        "Risk Compliance gleicht Daten geprüfter Betroffener nur über eine exakte, getrennt "
+                        "verifizierte Betroffenenreferenz ab. Eine Konto- oder Mitgliedschaftskennung ermittelt "
+                        "unabhängig eigene Zuschreibungen zu Bedienung, Prüfung, Import, Ausnahme und Assurance-Graph. "
+                        "Suchen können auf eine Prüfungs- oder Assurance-Revision eingegrenzt werden; eine "
+                        "Objektkennung allein begründet niemals Identität. Betroffenenexporte enthalten begrenzte "
+                        "übermittelte Namen, Aliase, Kennungen, Daten, Adressen und das Lebenszyklusergebnis der Prüfung. "
+                        "Sanktionsdaten Dritter, Kandidatenabgleichsnachweise, Fingerabdrücke, Prüfsummen, "
+                        "Richtliniensnapshots, Begründungen prüfender Personen, Zuständigkeitskontext, Provenienz und "
+                        "Nachweisreferenzen bleiben ausgeschlossen. Versionsgebundene Prüfungen, Dispositionen, Ausnahmen "
+                        "und Assurance-Revisionen bleiben als rechtliche und verantwortungsbezogene Nachweise erhalten."
+                    ),
+                }
+            },
+            structured_translation_version="1",
+            structured_translations={
+                "de": {
+                    "consequence_classes": {
+                        "export_screening_subject": (
+                            "Gibt begrenzte Betroffeneneingaben und Lebenszyklusdaten für eine exakte Referenz zurück."
+                        ),
+                        "exclude_third_party_evidence": (
+                            "Gibt niemals Sanktionslisteneinträge, Abgleichsnachweise oder geschützte Prüfungsinhalte zurück."
+                        ),
+                        "retain_compliance_evidence": (
+                            "Bewahrt versionsgebundene Rechts-, Audit- und Verantwortungsnachweise auf."
+                        ),
+                    }
+                }
+            },
+        ),
+        *DOCUMENTATION,
+    ),
 )
 
 

tests/test_documentation.py

@@ -0,0 +1,31 @@
+from __future__ import annotations
+
+import unittest
+
+from govoplan_core.core.modules import (
+    documentation_structured_translation_issues,
+    user_workflow_scope_condition_issues,
+)
+from govoplan_risk_compliance.backend.manifest import manifest
+
+
+class RiskComplianceDocumentationTests(unittest.TestCase):
+    def test_public_topics_have_complete_german_reference_content(self) -> None:
+        self.assertEqual(2, len(manifest.documentation))
+        for topic in manifest.documentation:
+            translation = topic.translations.get("de", {})
+            self.assertTrue(
+                all(translation.get(key) for key in ("title", "summary", "body"))
+            )
+            self.assertEqual((), documentation_structured_translation_issues(topic))
+
+    def test_documentation_has_scope_conditioned_workflow_and_reference(self) -> None:
+        kinds = {topic.metadata.get("kind") for topic in manifest.documentation}
+        self.assertIn("workflow", kinds)
+        self.assertIn("reference", kinds)
+        for topic in manifest.documentation:
+            self.assertEqual((), user_workflow_scope_condition_issues(topic))
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/test_dsar_provider.py

@@ -0,0 +1,468 @@
+from __future__ import annotations
+
+import json
+import unittest
+from datetime import UTC, datetime, timedelta
+
+from sqlalchemy import create_engine
+from sqlalchemy.orm import Session
+
+from govoplan_core.core.dsar import DsarProvider, DsarSubjectRef
+from govoplan_core.db.base import Base
+from govoplan_core.privacy.dsar_workflow import (
+    create_data_subject_request,
+    search_data_subject_request,
+)
+from govoplan_risk_compliance.backend.db.models import (
+    RiskAssuranceEdge,
+    RiskAssuranceNode,
+    RiskSanctionsEntry,
+    RiskSanctionsListSnapshot,
+    RiskScreeningCandidate,
+    RiskScreeningDisposition,
+    RiskScreeningException,
+    RiskScreeningRun,
+    RiskScreeningSubjectSnapshot,
+)
+from govoplan_risk_compliance.backend.dsar_provider import (
+    RISK_COMPLIANCE_DSAR_CAPABILITY,
+    RiskComplianceDsarProvider,
+)
+from govoplan_risk_compliance.backend.manifest import manifest
+
+
+NOW = datetime(2026, 8, 22, 10, 0, tzinfo=UTC)
+
+
+class _Registry:
+    def __init__(self, provider: RiskComplianceDsarProvider) -> None:
+        self.provider = provider
+
+    def capability_names(self):
+        return (RISK_COMPLIANCE_DSAR_CAPABILITY,)
+
+    def capability_owner(self, name):
+        if name != RISK_COMPLIANCE_DSAR_CAPABILITY:
+            raise KeyError(name)
+        return "risk_compliance"
+
+    def tenant_entitlement_resolver(self):
+        class _Resolver:
+            @staticmethod
+            def resolve(session, tenant_id):
+                del session, tenant_id
+                return type("State", (), {"effective_modules": ("risk_compliance",)})()
+
+        return _Resolver()
+
+    def require_tenant_capability(self, name, session, **kwargs):
+        del session, kwargs
+        if name != RISK_COMPLIANCE_DSAR_CAPABILITY:
+            raise KeyError(name)
+        return self.provider
+
+    def manifests(self):
+        return (type("Manifest", (), {"id": "risk_compliance"})(),)
+
+
+class RiskComplianceDsarProviderTests(unittest.TestCase):
+    def setUp(self) -> None:
+        self.engine = create_engine("sqlite+pysqlite:///:memory:")
+        Base.metadata.create_all(self.engine)
+        self.session = Session(self.engine)
+        self.provider = RiskComplianceDsarProvider()
+        self.assertIsInstance(self.provider, DsarProvider)
+        self._seed()
+        self.session.commit()
+
+    def tearDown(self) -> None:
+        self.session.close()
+        self.engine.dispose()
+
+    def _seed(self) -> None:
+        list_snapshot = RiskSanctionsListSnapshot(
+            id="list-1",
+            tenant_id="tenant-1",
+            visibility="tenant",
+            connector_snapshot_ref="connector:snapshot:secret-do-not-export",
+            provider_id="un",
+            publisher="United Nations",
+            jurisdiction="global",
+            list_type="sanctions",
+            source_id="consolidated",
+            source_version="2026-08-22",
+            publication_at=NOW,
+            effective_at=NOW,
+            acquired_at=NOW,
+            sha256="list-sha-do-not-export",
+            connector_run_id="connector-run-do-not-export",
+            raw_evidence_ref="evidence-ref-do-not-export",
+            source_parser_version="parser-v1",
+            normalization_version="normalizer-v1",
+            signature_evidence={"secret": "signature-do-not-export"},
+            provenance={"secret": "provenance-do-not-export"},
+            entry_count=1,
+            status="active",
+            imported_by="account-1",
+            imported_at=NOW,
+            created_at=NOW,
+            updated_at=NOW,
+        )
+        subject_snapshot = RiskScreeningSubjectSnapshot(
+            id="subject-snapshot-1",
+            tenant_id="tenant-1",
+            subject_ref="party:person-1",
+            subject_type="person",
+            primary_name="Ada Example",
+            normalized_name="ada example normalized-do-not-export",
+            aliases=["Ada E."],
+            identifiers=[
+                {
+                    "type": "resident-number",
+                    "value": "resident-123",
+                    "unexpected": "identifier-extra-do-not-export",
+                }
+            ],
+            dates=["1990-01-01"],
+            addresses=[
+                {
+                    "street": "Example Street 1",
+                    "city": "Exampletown",
+                    "country": "DE",
+                    "unexpected": "address-extra-do-not-export",
+                }
+            ],
+            fingerprint="subject-fingerprint-do-not-export",
+            submitted_by="account-1",
+            created_at=NOW,
+            updated_at=NOW,
+        )
+        run = RiskScreeningRun(
+            id="screening-1",
+            tenant_id="tenant-1",
+            subject_snapshot_id="subject-snapshot-1",
+            list_snapshot_id="list-1",
+            idempotency_key="screening-idempotency-do-not-export",
+            request_hash="screening-request-hash-do-not-export",
+            matcher_version="matcher-v1",
+            normalization_version="normalizer-v1",
+            policy_version="policy-v1",
+            policy_snapshot={"secret": "policy-snapshot-do-not-export"},
+            status="complete",
+            outcome="review",
+            candidate_count=1,
+            started_at=NOW,
+            completed_at=NOW,
+            created_by="account-1",
+            created_at=NOW,
+            updated_at=NOW,
+        )
+        sanctions_entry = RiskSanctionsEntry(
+            id="entry-1",
+            snapshot_id="list-1",
+            source_entry_id="third-party-entry-do-not-export",
+            subject_type="person",
+            primary_name="Third Party Name Do Not Export",
+            normalized_name="third party",
+            original_script_name=None,
+            reference_number="third-party-reference-do-not-export",
+            listed_on=None,
+            programmes=[],
+            measures=[],
+            raw_evidence_locator="third-party-evidence-do-not-export",
+            details={"secret": "third-party-details-do-not-export"},
+            created_at=NOW,
+            updated_at=NOW,
+        )
+        candidate = RiskScreeningCandidate(
+            id="candidate-1",
+            tenant_id="tenant-1",
+            run_id="screening-1",
+            entry_id="entry-1",
+            score=91,
+            match_kind="fuzzy",
+            evidence=[{"secret": "candidate-evidence-do-not-export"}],
+            review_status="confirmed",
+            current_disposition_id="disposition-1",
+            created_at=NOW,
+            updated_at=NOW,
+        )
+        disposition = RiskScreeningDisposition(
+            id="disposition-1",
+            tenant_id="tenant-1",
+            candidate_id="candidate-1",
+            decision="false_positive",
+            reason="review-reason-do-not-export",
+            evidence_refs=["review-evidence-do-not-export"],
+            scope="subject_entry",
+            expires_at=NOW + timedelta(days=30),
+            review_at=NOW + timedelta(days=15),
+            actor_account_id="account-1",
+            actor_membership_id="membership-1",
+            actor_authority={"secret": "authority-do-not-export"},
+            separation_status="independent",
+            override_reason="override-reason-do-not-export",
+            created_at=NOW,
+        )
+        exception = RiskScreeningException(
+            id="exception-1",
+            tenant_id="tenant-1",
+            subject_fingerprint="exception-fingerprint-do-not-export",
+            source_entry_ref="exception-source-entry-do-not-export",
+            scope="subject_entry",
+            status="active",
+            reason="exception-reason-do-not-export",
+            evidence_refs=["exception-evidence-do-not-export"],
+            starts_at=NOW,
+            expires_at=NOW + timedelta(days=30),
+            review_at=NOW + timedelta(days=15),
+            originating_disposition_id="disposition-1",
+            created_by="account-1",
+            created_at=NOW,
+            updated_at=NOW,
+        )
+        node = RiskAssuranceNode(
+            id="node-1",
+            tenant_id="tenant-1",
+            stable_id="control-1",
+            kind="control",
+            revision=1,
+            label="Sensitive control label do not export",
+            description="Sensitive control description do not export",
+            state="active",
+            owner_ref="owner-secret-do-not-export",
+            scope_ref="scope-secret-do-not-export",
+            governed_object_ref="object-secret-do-not-export",
+            valid_from=NOW,
+            recorded_at=NOW,
+            provenance={"secret": "node-provenance-do-not-export"},
+            legal_basis_refs=["legal-secret-do-not-export"],
+            policy_refs=["policy-secret-do-not-export"],
+            evidence_refs=["node-evidence-do-not-export"],
+            classification="restricted",
+            created_by="account-1",
+            created_at=NOW,
+            updated_at=NOW,
+        )
+        edge = RiskAssuranceEdge(
+            id="edge-1",
+            tenant_id="tenant-1",
+            stable_id="relation-1",
+            revision=1,
+            source_node_ref="control-1",
+            target_node_ref="risk-1",
+            relation="mitigates",
+            state="active",
+            owner_ref="edge-owner-secret-do-not-export",
+            scope_ref="edge-scope-secret-do-not-export",
+            valid_from=NOW,
+            recorded_at=NOW,
+            provenance={"secret": "edge-provenance-do-not-export"},
+            legal_basis_refs=["edge-legal-secret-do-not-export"],
+            policy_refs=["edge-policy-secret-do-not-export"],
+            evidence_refs=["edge-evidence-do-not-export"],
+            created_by="account-1",
+            created_at=NOW,
+            updated_at=NOW,
+        )
+        other_tenant_node = RiskAssuranceNode(
+            id="node-other",
+            tenant_id="tenant-2",
+            stable_id="other-control",
+            kind="control",
+            revision=1,
+            label="Other tenant",
+            state="active",
+            owner_ref="owner",
+            valid_from=NOW,
+            recorded_at=NOW,
+            provenance={},
+            legal_basis_refs=[],
+            policy_refs=[],
+            evidence_refs=[],
+            classification="internal",
+            created_by="account-1",
+        )
+        self.session.add_all(
+            (
+                list_snapshot,
+                subject_snapshot,
+                run,
+                sanctions_entry,
+                candidate,
+                disposition,
+                exception,
+                node,
+                edge,
+                other_tenant_node,
+            )
+        )
+
+    @staticmethod
+    def _subject() -> DsarSubjectRef:
+        return DsarSubjectRef(
+            account_id="account-1",
+            membership_id="membership-1",
+            external_references={
+                "risk_compliance.subject": "party:person-1",
+            },
+        )
+
+    def test_search_exports_subject_data_and_minimized_attribution(self) -> None:
+        records = self.provider.search_subject(
+            self.session, tenant_id="tenant-1", subject=self._subject()
+        )
+        self.assertEqual(
+            {
+                "screening_subject_submission",
+                "screening_actor_attribution",
+                "snapshot_import_actor_attribution",
+                "disposition_actor_attribution",
+                "exception_actor_attribution",
+                "assurance_node_actor_attribution",
+                "assurance_edge_actor_attribution",
+            },
+            {record.resource_type for record in records},
+        )
+        exported = json.dumps([record.to_dict() for record in records])
+        self.assertIn("Ada Example", exported)
+        self.assertIn("resident-123", exported)
+        for excluded in (
+            "normalized-do-not-export",
+            "identifier-extra-do-not-export",
+            "address-extra-do-not-export",
+            "subject-fingerprint-do-not-export",
+            "screening-idempotency-do-not-export",
+            "screening-request-hash-do-not-export",
+            "policy-snapshot-do-not-export",
+            "Third Party Name Do Not Export",
+            "third-party-reference-do-not-export",
+            "candidate-evidence-do-not-export",
+            "review-reason-do-not-export",
+            "review-evidence-do-not-export",
+            "authority-do-not-export",
+            "override-reason-do-not-export",
+            "exception-fingerprint-do-not-export",
+            "exception-source-entry-do-not-export",
+            "exception-reason-do-not-export",
+            "Sensitive control label do not export",
+            "node-provenance-do-not-export",
+            "edge-owner-secret-do-not-export",
+            "edge-evidence-do-not-export",
+            "list-sha-do-not-export",
+            "signature-do-not-export",
+        ):
+            self.assertNotIn(excluded, exported)
+
+    def test_subject_data_requires_exact_module_reference(self) -> None:
+        account_only = self.provider.search_subject(
+            self.session,
+            tenant_id="tenant-1",
+            subject=DsarSubjectRef(account_id="account-1"),
+        )
+        reference_only = self.provider.search_subject(
+            self.session,
+            tenant_id="tenant-1",
+            subject=DsarSubjectRef(
+                external_references={
+                    "risk_compliance.subject": "party:person-1",
+                }
+            ),
+        )
+        self.assertNotIn(
+            "screening_subject_submission",
+            {record.resource_type for record in account_only},
+        )
+        self.assertEqual(
+            {"screening_subject_submission"},
+            {record.resource_type for record in reference_only},
+        )
+
+    def test_conflicts_narrowing_and_tenant_boundaries(self) -> None:
+        conflict = self.provider.search_subject(
+            self.session,
+            tenant_id="tenant-1",
+            subject=DsarSubjectRef(
+                account_id="account-1",
+                external_references={
+                    "risk_compliance.account": "account-other",
+                },
+            ),
+        )
+        narrowed = self.provider.search_subject(
+            self.session,
+            tenant_id="tenant-1",
+            subject=DsarSubjectRef(
+                account_id="account-1",
+                external_references={
+                    "risk_compliance.subject": "party:person-1",
+                    "risk_compliance.screening": "screening-1",
+                },
+            ),
+        )
+        full = self.provider.search_subject(
+            self.session, tenant_id="tenant-1", subject=self._subject()
+        )
+        self.assertEqual((), conflict)
+        self.assertEqual(
+            {
+                "screening_subject_submission",
+                "screening_actor_attribution",
+                "disposition_actor_attribution",
+            },
+            {record.resource_type for record in narrowed},
+        )
+        self.assertNotIn("node-other", {record.resource_id for record in full})
+
+    def test_erasure_retains_legal_and_accountability_evidence(self) -> None:
+        records = self.provider.search_subject(
+            self.session, tenant_id="tenant-1", subject=self._subject()
+        )
+        actions = self.provider.plan_erasure(
+            self.session,
+            tenant_id="tenant-1",
+            subject=self._subject(),
+            records=records,
+        )
+        self.assertTrue(actions)
+        self.assertTrue(
+            all(action.kind == "retain" and not action.executable for action in actions)
+        )
+        results = self.provider.execute_erasure(
+            self.session,
+            tenant_id="tenant-1",
+            subject=self._subject(),
+            actions=actions,
+            request_id="dsar-risk-1",
+        )
+        self.assertTrue(all(result.status == "blocked" for result in results))
+
+    def test_manifest_and_core_workflow_discover_provider(self) -> None:
+        self.assertIn(RISK_COMPLIANCE_DSAR_CAPABILITY, manifest.capability_factories)
+        self.assertIn(
+            "risk_compliance.data-subject-requests",
+            {topic.id for topic in manifest.documentation},
+        )
+        row = create_data_subject_request(
+            self.session,
+            tenant_id="tenant-1",
+            reference="DSAR-RISK-1",
+            request_kind="access",
+            subject=self._subject(),
+            purpose="Risk screening access request",
+            legal_basis=None,
+            due_at=None,
+            requested_by_account_id="operator-1",
+        )
+        search_data_subject_request(
+            self.session,
+            registry=_Registry(self.provider),
+            row=row,
+            expected_revision=row.resource_revision,
+        )
+        self.assertEqual("searched", row.status)
+        self.assertEqual(7, row.search_result["record_count"])
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/test_manifest.py

@@ -6,6 +6,9 @@ from govoplan_core.core.sanctions import (
     CAPABILITY_RISK_COMPLIANCE_SANCTIONS_SCREENING,
     SanctionsScreeningProvider,
 )
+from govoplan_risk_compliance.backend.dsar_provider import (
+    RISK_COMPLIANCE_DSAR_CAPABILITY,
+)
 from govoplan_risk_compliance.backend.manifest import (
     ADMIN_SCOPE,
     READ_SCOPE,
@@ -27,10 +30,7 @@ class ManifestTests(unittest.TestCase):
         self.assertEqual(manifest.dependencies, ("access",))
         self.assertIn("connectors", manifest.optional_dependencies)
         self.assertEqual(
-            {
+            {permission.scope for permission in manifest.permissions},
-                permission.scope
-                for permission in manifest.permissions
-            },
             {
                 READ_SCOPE,
                 WRITE_SCOPE,
@@ -59,11 +59,11 @@ class ManifestTests(unittest.TestCase):
         )
         self.assertTrue(manifest.requires_interfaces[0].optional)
         self.assertEqual(
-            {"risk_compliance.sanctions_screening"},
             {
-                item.name
+                "risk_compliance.sanctions_screening",
-                for item in manifest.provides_interfaces
+                RISK_COMPLIANCE_DSAR_CAPABILITY,
             },
+            {item.name for item in manifest.provides_interfaces},
         )
         capability = manifest.capability_factories[
             CAPABILITY_RISK_COMPLIANCE_SANCTIONS_SCREENING

webui/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@govoplan/risk-compliance-webui",
-  "version": "0.1.15",
+  "version": "0.1.19",
   "private": true,
   "type": "module",
   "main": "src/index.ts",
@@ -14,7 +14,7 @@
     "./styles/risk-compliance.css": "./src/styles/risk-compliance.css"
   },
   "peerDependencies": {
-    "@govoplan/core-webui": "^0.1.15",
+    "@govoplan/core-webui": "^0.1.18",
     "lucide-react": "^1.23.0",
     "react": ">=19.2.7 <20",
     "react-dom": ">=19.2.7 <20",

webui/src/features/riskCompliance/RiskCompliancePage.tsx

@@ -1,3 +1,4 @@
+import { MetricGrid } from "@govoplan/core-webui";
 import {
   CheckCircle2,
   Database,
@@ -17,7 +18,7 @@ import {
   type FormEvent
 } from "react";
 import { useSearchParams } from "react-router";
-import {
+import { FormGrid, ActionToolbar, ToolbarSpacer,
   ActionBlockerHint,
   Button,
   ConfirmDialog,
@@ -31,6 +32,7 @@ import {
   SegmentedControl,
   SelectionList,
   SelectionListItem,
+  StatePanel,
   StatusBadge,
   ToggleSwitch,
   hasScope,
@@ -247,7 +249,7 @@ export default function RiskCompliancePage({
 
   return (
     <main className="risk-page">
-      <div className="risk-toolbar">
+      <ActionToolbar className="risk-toolbar">
         <SegmentedControl
           value={view}
           onChange={setView}
@@ -300,7 +302,7 @@ export default function RiskCompliancePage({
             }
           ]}
         />
-        <span className="risk-toolbar-spacer" />
+        <ToolbarSpacer className="risk-toolbar-spacer" />
         <DocumentationHelpLink reference={RISK_COMPLIANCE_DOCUMENTATION} />
         {loading && <LoadingIndicator size="sm" label="Loading" />}
         <IconButton
@@ -310,7 +312,7 @@ export default function RiskCompliancePage({
           disabled={loading || busy}
           disabledReason={loading ? RISK_COMPLIANCE_I18N.loading : busy ? RISK_COMPLIANCE_I18N.busy : undefined}
         />
-      </div>
+      </ActionToolbar>
       {(error || notice) && (
         <div className="risk-alerts">
           {error && (
@@ -493,9 +495,7 @@ function SourcesPane({
             </div>
           ))}
           {!imported.length && (
-            <div className="risk-empty">
+            <StatePanel size="compact" description="No source snapshot has been imported." />
-              No source snapshot has been imported.
-            </div>
           )}
         </div>
       </div>
@@ -664,26 +664,15 @@ function ScreenPane({
           {run && <StatusBadge status={run.outcome} />}
         </header>
         {!run && (
-          <div className="risk-empty">
+          <StatePanel size="compact" description="Run a screening to inspect the result." />
-            Run a screening to inspect the result.
-          </div>
         )}
         {run && (
           <div className="risk-result-body">
-            <div className="risk-metrics">
+            <MetricGrid columns={3} density="compact" spacing="none" minimum="compact">
-              <span>
+              <MetricCard density="compact" surface="flat" label="Candidates" value={run.candidate_count} />
-                <strong>{run.candidate_count}</strong>
+              <MetricCard density="compact" surface="flat" label="Matcher" value={run.matcher_version} />
-                candidates
+              <MetricCard density="compact" surface="flat" label="List" value={run.list_snapshot.source_version} />
-              </span>
+            </MetricGrid>
-              <span>
-                <strong>{run.matcher_version}</strong>
-                matcher
-              </span>
-              <span>
-                <strong>{run.list_snapshot.source_version}</strong>
-                list
-              </span>
-            </div>
             {run.candidates.map((item) => (
               <div className="risk-candidate-summary" key={item.id}>
                 <span className="risk-score">{item.score}</span>
@@ -825,9 +814,7 @@ function ReviewPane({
             </SelectionList>
           )}
           {!queue.length && (
-            <div className="risk-empty">
+            <StatePanel size="compact" description="No candidates currently need review." />
-              No candidates currently need review.
-            </div>
           )}
         </div>
       </aside>
@@ -850,9 +837,7 @@ function ReviewPane({
           </div>
         </header>
         {!detail && (
-          <div className="risk-empty">
+          <StatePanel size="compact" description="Select a candidate from the queue." />
-            Select a candidate from the queue.
-          </div>
         )}
         {detail && (
           <div className="risk-evidence-body">
@@ -1249,7 +1234,7 @@ function AssurancePane({
             documentation={RISK_COMPLIANCE_DOCUMENTATION}
           />
         )}
-        <div className="metric-grid risk-assurance-metrics">
+        <MetricGrid minimum="fluid" className="risk-assurance-metrics">
           <MetricCard label="Objects" value={summary?.node_count ?? 0} tone="neutral" />
           <MetricCard label="Relationships" value={summary?.edge_count ?? 0} tone="neutral" />
           <MetricCard label="Risks" value={summary?.by_kind.risk ?? 0} tone="warning" />
@@ -1258,7 +1243,7 @@ function AssurancePane({
             value={summary?.by_state.open ?? 0}
             tone={(summary?.by_state.open ?? 0) > 0 ? "danger" : "good"}
           />
-        </div>
+        </MetricGrid>
       </div>
       <div className="risk-assurance-columns">
         <aside className="risk-panel">
@@ -1317,7 +1302,7 @@ function AssurancePane({
               </SelectionList>
             )}
             {!visibleNodes.length && (
-              <div className="risk-empty">No assurance objects match.</div>
+              <StatePanel size="compact" description="No assurance objects match." />
             )}
           </div>
         </aside>
@@ -1339,7 +1324,7 @@ function AssurancePane({
             </div>
           </header>
           {!selected && (
-            <div className="risk-empty">Select an assurance object.</div>
+            <StatePanel size="compact" description="Select an assurance object." />
           )}
           {selected && (
             <div className="risk-assurance-detail-body">
@@ -1379,7 +1364,7 @@ function AssurancePane({
                   />
                 ))}
                 {!graph?.edges.length && (
-                  <div className="risk-empty">No relationships are recorded.</div>
+                  <StatePanel size="inline" description="No relationships are recorded." />
                 )}
               </div>
               {graph?.truncated && (
@@ -1523,7 +1508,7 @@ function AssuranceNodeDialog({
     >
       <DocumentationHelpLink reference={RISK_COMPLIANCE_DOCUMENTATION} />
       <form id="risk-assurance-node-form" className="risk-assurance-form" onSubmit={onSubmit}>
-        <div className="risk-assurance-form-grid">
+        <FormGrid columns={2} gap="compact" collapseAt="narrow">
           <FormField label="Stable ID">
             <input
               value={draft.stableId}
@@ -1582,11 +1567,11 @@ function AssuranceNodeDialog({
           <FormField label="Valid to">
             <input type="datetime-local" value={draft.validTo} onChange={(event) => update({ validTo: event.target.value })} />
           </FormField>
-        </div>
+        </FormGrid>
         <FormField label="Description">
           <textarea value={draft.description} onChange={(event) => update({ description: event.target.value })} rows={4} maxLength={20000} />
         </FormField>
-        <div className="risk-assurance-form-grid">
+        <FormGrid columns={2} gap="compact" collapseAt="narrow">
           <FormField label="Legal basis references">
             <textarea value={draft.legalBasisRefs} onChange={(event) => update({ legalBasisRefs: event.target.value })} rows={3} />
           </FormField>
@@ -1596,7 +1581,7 @@ function AssuranceNodeDialog({
           <FormField label="Evidence references">
             <textarea value={draft.evidenceRefs} onChange={(event) => update({ evidenceRefs: event.target.value })} rows={3} />
           </FormField>
-        </div>
+        </FormGrid>
       </form>
     </Dialog>
   );

webui/src/styles/risk-compliance.css

@@ -28,9 +28,9 @@
 
 .risk-count {
   min-width: 18px;
-  border-radius: 9px;
+  border-radius: var(--radius-md);
   background: var(--accent);
-  color: #fff;
+  color: var(--on-dark);
   padding: 1px 5px;
   font-size: 10px;
   text-align: center;
@@ -79,10 +79,6 @@
   gap: 10px;
 }
 
-.risk-assurance-metrics {
-  grid-template-columns: repeat(4, minmax(0, 1fr));
-}
-
 .risk-assurance-columns {
   display: grid;
   min-width: 0;
@@ -226,19 +222,13 @@
   gap: 12px;
 }
 
-.risk-assurance-form-grid {
-  display: grid;
-  grid-template-columns: repeat(2, minmax(0, 1fr));
-  gap: 10px 12px;
-}
-
 .risk-panel {
   display: flex;
   min-width: 0;
   min-height: 0;
   flex-direction: column;
   border: var(--border-line);
-  border-radius: 6px;
+  border-radius: var(--radius-compact);
   background: var(--surface);
   overflow: hidden;
 }
@@ -337,12 +327,6 @@
   font-size: 11px;
 }
 
-.risk-empty {
-  color: var(--muted);
-  padding: 24px;
-  text-align: center;
-}
-
 .risk-form-body {
   display: grid;
   align-content: start;
@@ -364,34 +348,6 @@
   justify-self: start;
 }
 
-.risk-metrics {
-  display: grid;
-  grid-template-columns: repeat(3, minmax(0, 1fr));
-  border-bottom: var(--border-line);
-}
-
-.risk-metrics > span {
-  display: grid;
-  min-width: 0;
-  gap: 4px;
-  border-right: var(--border-line);
-  color: var(--muted);
-  padding: 12px;
-  font-size: 11px;
-}
-
-.risk-metrics > span:last-child {
-  border-right: 0;
-}
-
-.risk-metrics strong {
-  overflow: hidden;
-  color: var(--text-strong);
-  text-overflow: ellipsis;
-  white-space: nowrap;
-  font-size: 14px;
-}
-
 .risk-score {
   display: inline-grid;
   width: 38px;
@@ -399,7 +355,7 @@
   flex: 0 0 38px;
   place-items: center;
   border: 1px solid var(--warning-border);
-  border-radius: 4px;
+  border-radius: var(--radius-sm);
   background: var(--warning-soft);
   color: var(--text-strong);
   font-weight: 700;
@@ -496,7 +452,7 @@
   gap: 14px;
 }
 
-@media (max-width: 920px) {
+@media (max-width: 900px) {
   .risk-workspace {
     overflow: auto;
   }
@@ -514,7 +470,6 @@
     grid-template-columns: repeat(2, minmax(0, 1fr));
   }
 
-  .risk-assurance-form-grid,
   .risk-assurance-properties {
     grid-template-columns: minmax(0, 1fr);
   }