[User Story] Screen persons and organizations against versioned sanctions and embargo sources #12

New Issue

2026-07-20T15:13:23+02:00

zemion commented

2026-07-20 15:13:23 +02:00

User Story

As an export-control or compliance reviewer responsible for a governed action, I want persons, organizations, and relevant destination jurisdictions screened against configured sanctions and embargo sources, so that potential restrictions stop or enter review before the action proceeds and every result remains reproducible, contestable, privacy-aware, and auditable.

Product Scope

This is a product-level GovOPlaN capability and is deliberately independent of any single operational module or Workflow. The implementation must expose an explicit, permissioned screening and evidence contract. Concrete consumers, triggering contexts, and module ownership are separate integration decisions; no domain record is screened or blocked implicitly.

Ownership Boundary

The GovOPlaN meta backlog owns this user story and its cross-system contract. The eventual implementation boundary must cover source registration and immutable snapshots, normalized entries and aliases, screening runs and candidates, review dispositions and exceptions, freshness and reconciliation policy, evidence references, and reviewer-facing interfaces. The concrete repository/module composition is intentionally undecided. Existing domain modules retain ownership of their records; audit and retention remain governed platform capabilities.

Acceptance Criteria

Each source snapshot records publisher, jurisdiction/list type, source ID, publication/effective/acquisition time, version, checksum or signature evidence, parser version, connector run, trust/licence metadata, and retained raw evidence where policy permits.
Source snapshots are immutable; every screening result pins the exact snapshot set and refreshing a source never rewrites historical results.
A screening request uses a minimal explicit snapshot of a person, organization, or destination, with tenant, purpose, originating resource reference, subject fingerprint, and normalization version.
Runs record matcher and policy versions, thresholds, source snapshots, input fingerprint, candidate evidence, and a deterministic idempotency key.
Results distinguish clear, potential_match, confirmed_match, false_positive, insufficient_data, source_stale, and source_unavailable; a fuzzy score alone never declares a legal match.
Candidate explanations identify contributing fields without exposing unrelated source or subject data.
Potential matches enter human review. No ambiguous subject is silently excluded or accepted.
False-positive and exception decisions record actor, authority, reason, evidence, scope, list record, subject fingerprint, expiry/review time, and supersession history; they become stale after relevant subject, source, or policy changes.
Refresh reconciliation identifies subjects requiring rescreening without altering completed historical evidence.
Tenant policy defines required contexts, freshness, unavailable-source behavior, separation of duties, and which dispositions may unblock a governed action.
Every future integration explicitly declares its trigger, subject mapping, invalidation rules, blocking or degraded behavior, freshness check, evidence reference, and authorized override path.
Source changes, screenings, dispositions, overrides, invalidations, gate decisions, and reconciliation emit audit evidence.
Scopes separate source administration, screening execution, review, override, and reporting.
Logs, diagnostics, notifications, and exports minimize or redact personal data; external providers receive subject data only when explicitly configured and their disclosure and provenance are visible.
Synthetic-list tests cover idempotency, tenant isolation, stale and unavailable sources, false-positive expiry, subject or source changes, authorization, privacy-safe logging, fail-closed and review behavior, and deterministic historical reproduction.

Reference Constraints

The European Commission sanctions overview states that its consolidated financial-sanctions list reflects adopted legal texts and is updated as needed.
The UN Security Council consolidated list is published in XML, HTML, and PDF and distinguishes persons/entities and the measures of each sanctions regime.
BAFA's embargo guidance explains that search lists are aids, binding legal texts remain authoritative, and suspected name matches require review using additional identifiers.

GovOPlaN therefore stores source and version provenance and supports review; it must not present automated matching as a legal conclusion.

Out Of Scope For The First Slice

Goods or technology classification, export-licence determination, end-use legal conclusions, customs filings, and automated declarations based only on fuzzy matching.

Deferred Status

Deferred by product decision on 2026-07-20. Do not start implementation until GovOPlaN has selected connector/provider boundaries for authoritative list sources, event or webhook contracts for rescreening and consuming systems, and the applicable privacy, retention, legal, and review policies. The story remains in the meta repository as the cross-system capability contract; no Campaign-specific implementation is implied.

Decisions Needed Before Live-Data Rollout

Authoritative publishers, jurisdictions, and source licensing.
Whether external screening services may receive subject data.
Initial subject fields, normalization, thresholds, and review policy.
Which governed actions and integration contexts require screening.
Override authority, separation of duties, and exception expiry.
Lawful basis and retention periods for subject snapshots and evidence.

## User Story As an export-control or compliance reviewer responsible for a governed action, I want persons, organizations, and relevant destination jurisdictions screened against configured sanctions and embargo sources, so that potential restrictions stop or enter review before the action proceeds and every result remains reproducible, contestable, privacy-aware, and auditable. ## Product Scope This is a product-level GovOPlaN capability and is deliberately independent of any single operational module or Workflow. The implementation must expose an explicit, permissioned screening and evidence contract. Concrete consumers, triggering contexts, and module ownership are separate integration decisions; no domain record is screened or blocked implicitly. ## Ownership Boundary The GovOPlaN meta backlog owns this user story and its cross-system contract. The eventual implementation boundary must cover source registration and immutable snapshots, normalized entries and aliases, screening runs and candidates, review dispositions and exceptions, freshness and reconciliation policy, evidence references, and reviewer-facing interfaces. The concrete repository/module composition is intentionally undecided. Existing domain modules retain ownership of their records; audit and retention remain governed platform capabilities. ## Acceptance Criteria - [ ] Each source snapshot records publisher, jurisdiction/list type, source ID, publication/effective/acquisition time, version, checksum or signature evidence, parser version, connector run, trust/licence metadata, and retained raw evidence where policy permits. - [ ] Source snapshots are immutable; every screening result pins the exact snapshot set and refreshing a source never rewrites historical results. - [ ] A screening request uses a minimal explicit snapshot of a person, organization, or destination, with tenant, purpose, originating resource reference, subject fingerprint, and normalization version. - [ ] Runs record matcher and policy versions, thresholds, source snapshots, input fingerprint, candidate evidence, and a deterministic idempotency key. - [ ] Results distinguish `clear`, `potential_match`, `confirmed_match`, `false_positive`, `insufficient_data`, `source_stale`, and `source_unavailable`; a fuzzy score alone never declares a legal match. - [ ] Candidate explanations identify contributing fields without exposing unrelated source or subject data. - [ ] Potential matches enter human review. No ambiguous subject is silently excluded or accepted. - [ ] False-positive and exception decisions record actor, authority, reason, evidence, scope, list record, subject fingerprint, expiry/review time, and supersession history; they become stale after relevant subject, source, or policy changes. - [ ] Refresh reconciliation identifies subjects requiring rescreening without altering completed historical evidence. - [ ] Tenant policy defines required contexts, freshness, unavailable-source behavior, separation of duties, and which dispositions may unblock a governed action. - [ ] Every future integration explicitly declares its trigger, subject mapping, invalidation rules, blocking or degraded behavior, freshness check, evidence reference, and authorized override path. - [ ] Source changes, screenings, dispositions, overrides, invalidations, gate decisions, and reconciliation emit audit evidence. - [ ] Scopes separate source administration, screening execution, review, override, and reporting. - [ ] Logs, diagnostics, notifications, and exports minimize or redact personal data; external providers receive subject data only when explicitly configured and their disclosure and provenance are visible. - [ ] Synthetic-list tests cover idempotency, tenant isolation, stale and unavailable sources, false-positive expiry, subject or source changes, authorization, privacy-safe logging, fail-closed and review behavior, and deterministic historical reproduction. ## Reference Constraints - The [European Commission sanctions overview](https://finance.ec.europa.eu/eu-and-world/sanctions-restrictive-measures/overview-sanctions-and-related-resources_en) states that its consolidated financial-sanctions list reflects adopted legal texts and is updated as needed. - The [UN Security Council consolidated list](https://main.un.org/securitycouncil/en/content/un-sc-consolidated-list) is published in XML, HTML, and PDF and distinguishes persons/entities and the measures of each sanctions regime. - [BAFA's embargo guidance](https://www.bafa.de/DE/Aussenwirtschaft/Ausfuhrkontrolle/Embargos/embargos.html) explains that search lists are aids, binding legal texts remain authoritative, and suspected name matches require review using additional identifiers. GovOPlaN therefore stores source and version provenance and supports review; it must not present automated matching as a legal conclusion. ## Out Of Scope For The First Slice Goods or technology classification, export-licence determination, end-use legal conclusions, customs filings, and automated declarations based only on fuzzy matching. ## Deferred Status Deferred by product decision on 2026-07-20. Do not start implementation until GovOPlaN has selected connector/provider boundaries for authoritative list sources, event or webhook contracts for rescreening and consuming systems, and the applicable privacy, retention, legal, and review policies. The story remains in the meta repository as the cross-system capability contract; no Campaign-specific implementation is implied. ## Decisions Needed Before Live-Data Rollout - Authoritative publishers, jurisdictions, and source licensing. - Whether external screening services may receive subject data. - Initial subject fields, normalization, thresholds, and review policy. - Which governed actions and integration contexts require screening. - Override authority, separation of duties, and exception expiry. - Lawful basis and retention periods for subject snapshots and evidence.

zemion referenced this issue from GovOPlaN/govoplan-risk-compliance

2026-07-20 15:13:27 +02:00

[Moved] [User Story] Screen persons and organizations against versioned sanctions and embargo sources #1

zemion referenced this issue from GovOPlaN/govoplan-risk-compliance

2026-07-20 15:13:27 +02:00

[Moved] [User Story] Screen persons and organizations against versioned sanctions and embargo sources #1

zemion commented

2026-07-20 16:42:22 +02:00

Product decision (2026-07-20): defer the complete export-control/sanctions capability for now. The missing prerequisites are source-system connectors/providers, webhook or event integration contracts, and governance decisions for live personal/compliance data. This remains the canonical meta user story and is not Campaign work.

zemion referenced this issue from GovOPlaN/govoplan-dataflow

2026-07-28 00:58:08 +02:00

[Epic] Deliver a governed Dataflow manager with graphical and SQL editing #1

zemion referenced this issue from GovOPlaN/govoplan-connectors

2026-07-28 00:58:10 +02:00

[Feature] Acquire and preserve immutable sanctions source snapshots #10

zemion referenced this issue from GovOPlaN/govoplan-risk-compliance

2026-07-28 00:58:10 +02:00

[Epic] Deliver reproducible sanctions and embargo screening with human review #2

zemion commented

2026-07-28 00:58:11 +02:00

Product decision on 2026-07-28 supersedes the blanket deferred status: sanctions screening is now a P1 product stream.

Synthetic, domain-model, matcher, review-UI, and connector-contract work may begin now. Live-source rollout and use as a blocking legal gate remain conditional on the listed source/licensing/privacy/retention/reviewer-policy decisions.

P1 Risk Compliance epic: GovOPlaN/govoplan-risk-compliance#2
P1 immutable source acquisition: GovOPlaN/govoplan-connectors#10
Supporting Dataflow foundation: GovOPlaN/govoplan-dataflow#1

This preserves the legal safeguards while allowing implementation to progress.

Product decision on 2026-07-28 supersedes the blanket deferred status: sanctions screening is now a P1 product stream. Synthetic, domain-model, matcher, review-UI, and connector-contract work may begin now. Live-source rollout and use as a blocking legal gate remain conditional on the listed source/licensing/privacy/retention/reviewer-policy decisions. - P1 Risk Compliance epic: https://git.add-ideas.de/GovOPlaN/govoplan-risk-compliance/issues/2 - P1 immutable source acquisition: https://git.add-ideas.de/GovOPlaN/govoplan-connectors/issues/10 - Supporting Dataflow foundation: https://git.add-ideas.de/GovOPlaN/govoplan-dataflow/issues/1 This preserves the legal safeguards while allowing implementation to progress.

zemion added the area/governance codex/ready module/connectors module/dataflow module/datasources module/risk-compliance

labels 2026-07-29 14:15:03 +02:00

zemion commented

2026-07-29 15:53:04 +02:00

Codex State: progress

Summary

Added an executable sanctions-screening golden flow with separate subject/list inputs, normalized typed expressions, matching, and exact expected output.

Changed Files

govoplan-dataflow/fixtures/golden/sanctions-screening

Verification

Golden-flow fixture test passed

Next / Blocked

Connect immutable sanctions snapshots from govoplan-connectors#10, add matching policy/thresholds, review decisions, evidence, and governed publication.

Suggested status label: status/in-progress

## Codex State: progress ### Summary - Added an executable sanctions-screening golden flow with separate subject/list inputs, normalized typed expressions, matching, and exact expected output. ### Changed Files - `govoplan-dataflow/fixtures/golden/sanctions-screening` ### Verification - `Golden-flow fixture test passed` ### Next / Blocked - Connect immutable sanctions snapshots from govoplan-connectors#10, add matching policy/thresholds, review decisions, evidence, and governed publication. Suggested status label: `status/in-progress`

zemion referenced this issue

2026-07-29 15:53:33 +02:00

[Roadmap] Deliver governed dataflows, search, and established-tool integration #19

zemion added

and removed

labels 2026-07-29 15:54:02 +02:00

zemion commented

2026-08-06 12:47:34 +02:00

Codex State: progress

A new cross-module target test now proves immutable Connector acquisition, idempotent Risk Compliance import/screening, independent reviewer disposition, clearance gating, source refresh invalidation, rescreening queue creation and recovery-operation evidence in one shared SQL state.

Commit: govoplan@69ba103; the test is part of tools/checks/check-focused.sh.

The story remains open for the approved authoritative live-source profile and production freshness/operations evidence; the test makes no live-source or legal-conformance claim.

## Codex State: progress A new cross-module target test now proves immutable Connector acquisition, idempotent Risk Compliance import/screening, independent reviewer disposition, clearance gating, source refresh invalidation, rescreening queue creation and recovery-operation evidence in one shared SQL state. Commit: `govoplan@69ba103`; the test is part of `tools/checks/check-focused.sh`. The story remains open for the approved authoritative live-source profile and production freshness/operations evidence; the test makes no live-source or legal-conformance claim.

zemion commented

2026-08-06 14:13:23 +02:00

The normalized source ideas and user-story orientation are now preserved in govoplan/docs/PRODUCT_INPUT_REGISTER.md. This issue remains the canonical live work item for the corresponding outcome.

The normalized source ideas and user-story orientation are now preserved in `govoplan/docs/PRODUCT_INPUT_REGISTER.md`. This issue remains the canonical live work item for the corresponding outcome.

zemion commented

2026-08-06 16:17:47 +02:00

Codex State: progress

Revalidated the sanctions-screening composition against the current connector, datasource, dataflow, and risk-compliance contracts; the focused composition check passes. No maturity claim is raised yet: named source freshness/rescreening operations and target evidence remain part of the open story.

## Codex State: progress Revalidated the sanctions-screening composition against the current connector, datasource, dataflow, and risk-compliance contracts; the focused composition check passes. No maturity claim is raised yet: named source freshness/rescreening operations and target evidence remain part of the open story.

zemion referenced this issue

2026-09-08 05:27:54 +02:00

[Roadmap] Deliver governed dataflows, search, and established-tool integration #19

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: GovOPlaN/govoplan#12