# Eve retention, access, and admin-audit governance

Reviewed: 2026-09-15 Owner task: 14.5 Machine record:
`eve-sota-retention-access-policy/2026-09-15.json`

## Decision

The fifteen data families admitted by Task 14.4 now have one operator-readable
retention and access record. A platform operator with `admin:*` can read it at
`GET /v1/admin/audit-log/policy`; tenant/workspace admin scopes remain denied.
The same response reports the integrity state of the hydrated audit window.

The admin audit trail uses the canonical `audit_event` compliance window: 2,555
days, with a maximum 30-day purge cadence. The deployable evaluates expiry on
startup and daily thereafter. A live legal hold or retention exception
referencing the actor, target, subject, tenant, or owner defers the delete. This
database-backed trail is the retained authority; this task does not claim an
independently bound cold archive.

## Audited access and integrity

Successful reads of events, investigations, and policy disclosure append an
`audit.access.*` event and await its durable write before replying.
Investigation create/update/delete/share/export events follow the same flush
rule. Cross- tenant reads require the exact platform scope `admin:*`.

Every new event carries an HMAC-SHA-256 seal over its canonical minimized fields
and the previous event hash for that operator. Production refuses to start
without a key of at least 32 bytes in `OSHUN_ADMIN_AUDIT_INTEGRITY_KEY`; the key
is not stored in PostgreSQL. Key ID, algorithm, predecessor hash, and event MAC
are stored inside the existing JSON column under reserved keys and are removed
from the public payload on read. Legacy rows are reported as unsealed. Missing
predecessors outside the bounded startup hydration window are reported as
external anchors, not silently called verified.

## Shadow-store prevention

Audit is metadata, not replay. Before persistence, the trace/log sensitive-data
guard scans titles, subtitles, links, targets, structured keys, and values.
Content-bearing keys such as prompt, transcript, body, message, document,
request/response, media, before/after, and description are omitted. Strings,
arrays, object fields, depth, and serialized payload bytes are capped; an
over-budget payload is replaced by an omission marker and SHA-256 source
binding. Investigation audit events retain filter shape and counts, never the
free-text needle, description, share token, or copied result set.

Actor, tenant, target, status, policy/version, time bounds, counts, and hashes
remain allowed because they are the minimum facts needed to attribute and
challenge privileged activity. They remain subject to Task 14.4 export,
deletion, hold, and no-resurrection controls.

## Explicit limits

- HMAC chains detect database-only edits while key custody stays separate;
  compromise of both database and key can permit recomputation.
- The in-process verifier can prove the hydrated window and its external
  anchors, not an unhydrated predecessor chain.
- Attachment, generated-file, share, and permalink governance remains Task 14.8;
  this task defines the classes it must consume but does not admit those
  surfaces.