Reviewed: 2026-09-15 Owner task: 14.5 Machine record:
eve-sota-retention-access-policy/2026-09-15.json
Decision#
The fifteen data families admitted by Task 14.4 now have one operator-readable
retention and access record. A platform operator with admin:* can read it at
GET /v1/admin/audit-log/policy; tenant/workspace admin scopes remain denied.
The same response reports the integrity state of the hydrated audit window.
The admin audit trail uses the canonical audit_event compliance window: 2,555
days, with a maximum 30-day purge cadence. The deployable evaluates expiry on
startup and daily thereafter. A live legal hold or retention exception
referencing the actor, target, subject, tenant, or owner defers the delete. This
database-backed trail is the retained authority; this task does not claim an
independently bound cold archive.
Audited access and integrity#
Successful reads of events, investigations, and policy disclosure append an
audit.access.* event and await its durable write before replying.
Investigation create/update/delete/share/export events follow the same flush
rule. Cross- tenant reads require the exact platform scope admin:*.
Every new event carries an HMAC-SHA-256 seal over its canonical minimized fields
and the previous event hash for that operator. Production refuses to start
without a key of at least 32 bytes in OSHUN_ADMIN_AUDIT_INTEGRITY_KEY; the key
is not stored in PostgreSQL. Key ID, algorithm, predecessor hash, and event MAC
are stored inside the existing JSON column under reserved keys and are removed
from the public payload on read. Legacy rows are reported as unsealed. Missing
predecessors outside the bounded startup hydration window are reported as
external anchors, not silently called verified.
Shadow-store prevention#
Audit is metadata, not replay. Before persistence, the trace/log sensitive-data guard scans titles, subtitles, links, targets, structured keys, and values. Content-bearing keys such as prompt, transcript, body, message, document, request/response, media, before/after, and description are omitted. Strings, arrays, object fields, depth, and serialized payload bytes are capped; an over-budget payload is replaced by an omission marker and SHA-256 source binding. Investigation audit events retain filter shape and counts, never the free-text needle, description, share token, or copied result set.
Actor, tenant, target, status, policy/version, time bounds, counts, and hashes remain allowed because they are the minimum facts needed to attribute and challenge privileged activity. They remain subject to Task 14.4 export, deletion, hold, and no-resurrection controls.
Explicit limits#
- HMAC chains detect database-only edits while key custody stays separate; compromise of both database and key can permit recomputation.
- The in-process verifier can prove the hydrated window and its external anchors, not an unhydrated predecessor chain.
- Attachment, generated-file, share, and permalink governance remains Task 14.8; this task defines the classes it must consume but does not admit those surfaces.