---
path: /studio/aja/privacy-protection
surface: studio
domain: aja
auth: signed-in + studio entitlement
source: apps/oshun/web/src/app/studio/aja/privacy-protection/page.tsx
status: walked
last_walked:
  '2026-05-29 automated runtime walk (Playwright headless) — render, /v1 data
  (2xx), console/page-errors, expected content, screenshot verified; live
  screen-reader, touch, offline, and telemetry-delivery checks pending a manual
  AT pass. Evidence: WALKTHROUGH/results/runtime-sweep-2026-05-29.md; body
  re-derived 2026-06-03 from current source (lane-console architecture)'
---

# Studio Aja · Privacy Protection

## Purpose

Admin lane console for the real selective-anonymization rule evaluator. The
operator submits a privacy policy (default anonymization config + priority-
ordered selective rules) plus a face detection (and an optional identity id);
the lane evaluates the policy against the detection and resolves the action and
anonymization config — the highest-priority matching rule decides the action and
config over identity, confidence, and geometric screen-region conditions.

## Entry points

- **Direct URL / bookmark** — `/studio/aja/privacy-protection`; metadata
  canonical to this path
- **Studio nav** — Domain-bridge studios section of `/studio`
- **Breadcrumb parent** — `/studio/aja/api-endpoints` (declared in the page.tsx
  breadcrumb `<ol>`)
- **Sibling quick-actions on this page**: API Endpoints, Back to Studio
- **Operator surfacing** — see
  [`../../studio-overview.md`](../../studio-overview.md)

## Layout regions

`page.tsx` renders inside `<ShellLayout active="studio">`:

- **Breadcrumb panel** (`data-aja-privacy-protection-breadcrumbs`):
  `<nav aria-label="Aja Privacy Protection breadcrumbs">` →
  `Studio / Aja API Endpoints / Privacy Protection`
- **Workspace** (`<StudioAjaPrivacyProtectionWorkspace />`, archetype: LEAF with
  a capability summary):
  - `<h1>` (`WorkspaceHeading`) "Aja Privacy Protection Workspace"
  - Summary `<p data-aja-privacy-protection-summary>` — enforcement lane runs a
    real selective-anonymization rule evaluator
  - **Capability Summary** panel
    (`data-aja-privacy-protection-capability-summary`, `<h2>Capability
    Summary</h2>`) — 4 `data-aja-privacy-protection-capability` cards:
    `privacy-control-plane`, `diagnostics-and-trace-observability`,
    `security-permission-audit-controls`, `api-parity-and-contract-assurance`
  - **Anonymization Policy Evaluation Lane** (`<h2 data-aja-pp-lane-heading>`
    "Anonymization Policy Evaluation Lane") — the live evaluate form
- **Route Map panel** (`data-aja-privacy-protection-route-map`): `<h2>Route
  Map</h2>` listing 6 entries from `STUDIO_AJA_PRIVACY_PROTECTION_ROUTE_MAP`
  (primary, scenes, exports, revisions, parity, governance)
- **Quick-action panel**: two `Link.quickAction` anchors — API Endpoints, Back
  to Studio workspace index

## States

- [ ] **Loading** — GETs the privacy console catalog on mount; renders
      `<p data-aja-pp-loading>` "Loading privacy console…"
- [ ] **Unauthorized** — 401/403 renders `data-aja-pp-unauthorized` ("Access
      restricted." + admin-scope message, default "Aja workspace scope required
      to evaluate privacy policy.")
- [ ] **Error** — non-OK / malformed / unreachable renders `data-aja-pp-error`
      ("Could not load the privacy console." + reason)
- [ ] **Ready (form)** — success renders `data-aja-pp-engine-summary`,
      `data-aja-pp-techniques`, and the `data-aja-pp-form`
- [ ] **Result** — a successful POST renders `data-aja-pp-verdict` with
      `data-aja-pp-verdict-headline` (action + matched rule or policy default)
      and (if present) `data-aja-pp-verdict-config` (technique · region)
- [ ] **Validation / evaluate error** — invalid policy JSON or POST failure
      renders `data-aja-pp-eval-error`
- [x] **Empty / Standalone PWA / offline** — N/A beyond the above; shell SSR,
      lane is a client fetch on mount

## Interactions

### Anonymization Policy Evaluation Lane (`data-aja-pp-form`)

- [ ] **Policy + detection** (`data-aja-pp-payload`, textarea, aria-label
      "privacy policy payload json") — defaults to a defaultConfig + 2-rule +
      detection payload
- [ ] **Identity ID** (`data-aja-pp-identity`, input, aria-label "identity id",
      optional)
- [ ] **"Evaluate policy"** (`data-aja-pp-submit`, submit) — fires
      `POST /v1/admin/aja/privacy-protection/evaluate` with the parsed payload
      (plus `identityId` if provided)

### Capability Summary

- [ ] **Capability cards** (4 × `<article>`) — non-interactive descriptive copy

### Route Map panel

- [ ] **Route entries** (6 × `<article>`) — non-interactive path+purpose

### Quick-action panel

- [ ] **"Open Aja API Endpoints workspace"** → `/studio/aja/api-endpoints`
- [ ] **"Back to Studio workspace index"** → `/studio`

## Data & contracts

- **Reads**: `GET /v1/admin/aja/privacy-protection` on mount — catalog
  `{ summary, techniques: string[], regions: string[], conditionTypes: string[],
  actions: string[] }`
- **Writes**: `POST /v1/admin/aja/privacy-protection/evaluate` — the policy +
  detection payload (+ optional identityId) → `{ result }` (action, matchedRule,
  config)
- **Realtime**: none
- **Caching**: client `fetch` on mount with `cache: 'no-store'` and
  `buildBffAuthHeaders()`; SSR shell only
- **Auth/role check**: BFF endpoints admin-scoped + fail-closed (401/403 →
  unauthorized render); route behind the signed-in + studio proxy gate

## Cross-references

- Parent: [`../../studio-overview.md`](../../studio-overview.md)
- Shell:
  [`../../../shell/04-auth-session.md`](../../../shell/04-auth-session.md)
- Sibling routes:
  [`./studio-aja-api-endpoints.md`](./studio-aja-api-endpoints.md) (breadcrumb
  parent)
- Component sources:
  - `apps/oshun/web/src/components/studio/StudioAjaPrivacyProtectionWorkspace.tsx`
  - `apps/oshun/web/src/components/studio/StudioAjaPrivacyProtectionRouteMap.ts`

## Open questions / known gaps

- [ ] Route-map sub-routes are advertised but have no `page.tsx` in V1