feat: cover tenant erasure evidence in DSAR

2026-08-24 16:07:38 +02:00
parent e412c7d1bd
commit bfc38a7bc9
4 changed files with 408 additions and 3 deletions
@@ -46,6 +46,14 @@ only after providers finish, a fresh inventory is clear, and delete vetoes and
 tenant counts are zero. The durable operation then removes its free-text reason
 and never stores typed confirmation, secrets, or erased tenant content.

+The module's `privacy.dsar.tenancy` provider returns bounded requester and
+approver roles, approval timestamps, operation state, and an unfinished
+request reason only to the corroborated account selector. These actor and
+checkpoint references are immutable authorization, separation-of-duties, and
+recovery evidence, so the provider returns an explicit non-executable retain
+action. Typed confirmation and credentials are never persisted; free-text
+reason is removed when the tenant-erasure operation completes.
+
 Tenant lifecycle planning uses registered tenant summary providers and delete
 veto providers. Modules that own tenant-scoped data must contribute summaries
 so destructive deletion cannot silently miss their rows.