Add governed DSAR coverage for Payments #2

New Issue

2026-08-21T04:22:05+02:00

zemion commented

2026-08-21 04:22:05 +02:00

Goal

Cover exact subject-linked payment obligations and payment-operator attribution in the Core data-subject request workflow tracked by GovOPlaN/govoplan#47.

Scope

provide and document privacy.dsar.payments
correlate an exact tenant payment row, payment ID, or human payment reference supplied as a verified external subject reference
export bounded obligation, reconciliation, event, source, context, and evidence-reference facts without arbitrary metadata or payloads
separately export minimized request/reconciliation/event actor attribution
retain all financial and reconciliation evidence with non-executable erasure actions
exclude source-domain payloads, payment-provider data, request hashes, idempotency keys, and credentials
add optional exact narrowing, result bounds, and Core workflow tests

Acceptance criteria

no fuzzy search of subjects, descriptions, context JSON, or source records
unrelated payments and tenants cannot be discovered
full financial data requires an exact verified payment identifier; actor-only searches remain minimized
all actions are retain-only pending financial/statutory retention policy
conflicting aliases and foreign records/actions fail closed
focused tests, Ruff, and manifest checks pass

## Goal Cover exact subject-linked payment obligations and payment-operator attribution in the Core data-subject request workflow tracked by GovOPlaN/govoplan#47. ## Scope - provide and document `privacy.dsar.payments` - correlate an exact tenant payment row, payment ID, or human payment reference supplied as a verified external subject reference - export bounded obligation, reconciliation, event, source, context, and evidence-reference facts without arbitrary metadata or payloads - separately export minimized request/reconciliation/event actor attribution - retain all financial and reconciliation evidence with non-executable erasure actions - exclude source-domain payloads, payment-provider data, request hashes, idempotency keys, and credentials - add optional exact narrowing, result bounds, and Core workflow tests ## Acceptance criteria - no fuzzy search of subjects, descriptions, context JSON, or source records - unrelated payments and tenants cannot be discovered - full financial data requires an exact verified payment identifier; actor-only searches remain minimized - all actions are retain-only pending financial/statutory retention policy - conflicting aliases and foreign records/actions fail closed - focused tests, Ruff, and manifest checks pass

zemion commented

2026-08-21 04:26:28 +02:00

Implemented and pushed in e08bc8b.

Payments now provides privacy.dsar.payments. Full financial records require an exact verified payment row/id/reference and include bounded obligations, reconciliations, typed evidence references, context references, and lifecycle facts. Actor-only requests receive minimized operator attribution. No fuzzy content/JSON/source scanning occurs, sensitive context keys are redacted, and arbitrary metadata, payloads, hashes, replay keys, inspection links, and provider data are excluded. All financial actions are retain-only. Verification: 10 tests passed, Ruff passed, and the 68/68 manifest registry check passed.

Implemented and pushed in `e08bc8b`. Payments now provides `privacy.dsar.payments`. Full financial records require an exact verified payment row/id/reference and include bounded obligations, reconciliations, typed evidence references, context references, and lifecycle facts. Actor-only requests receive minimized operator attribution. No fuzzy content/JSON/source scanning occurs, sensitive context keys are redacted, and arbitrary metadata, payloads, hashes, replay keys, inspection links, and provider data are excluded. All financial actions are retain-only. Verification: 10 tests passed, Ruff passed, and the 68/68 manifest registry check passed.

zemion closed this issue

2026-08-21 04:26:28 +02:00

zemion referenced this issue from GovOPlaN/govoplan

2026-08-21 04:43:55 +02:00

[Privacy] Complete DSAR provider coverage across data-owning modules #47

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: GovOPlaN/govoplan-payments#2