{
  "schemaVersion": "eve-sota-retention-access-policy.v1",
  "initiativeId": "eve-sota-gap-closure-2026-09-01",
  "taskId": "14.5",
  "reviewedOn": "2026-09-15",
  "operatorDisclosure": {
    "route": "/v1/admin/audit-log/policy",
    "requiredScope": "admin:*",
    "readsAudited": true,
    "deniedTenantAdmin": true
  },
  "adminAudit": {
    "retentionDays": 2555,
    "purgeCadenceDays": 30,
    "legalHoldAware": true,
    "integrityAlgorithm": "hmac-sha256-chain",
    "productionKeyExternal": true,
    "contentBearingFieldsOmitted": true,
    "maximumPayloadBytes": 16384
  },
  "families": [
    {
      "id": "conversations",
      "retentionDays": 30,
      "retentionDriver": "creation_timestamp",
      "legalHoldExtendsRetention": true,
      "accessPolicy": ["subject:self", "service:assistant"]
    },
    {
      "id": "operator-memory",
      "retentionDays": 365,
      "retentionDriver": "last_access_timestamp",
      "legalHoldExtendsRetention": false,
      "accessPolicy": ["subject:self", "operator:assigned-tenant"]
    },
    {
      "id": "semantic-memory",
      "retentionDays": 365,
      "retentionDriver": "last_access_timestamp",
      "legalHoldExtendsRetention": false,
      "accessPolicy": ["subject:self"]
    },
    {
      "id": "vector-indexes",
      "retentionDays": 90,
      "retentionDriver": "last_access_timestamp",
      "legalHoldExtendsRetention": false,
      "accessPolicy": ["subject:self", "service:personalization"]
    },
    {
      "id": "tool-caches",
      "retentionDays": 0,
      "retentionDriver": "request_ephemeral",
      "legalHoldExtendsRetention": false,
      "accessPolicy": ["service:owning-request"]
    },
    {
      "id": "screenshots",
      "retentionDays": 0,
      "retentionDriver": "request_ephemeral",
      "legalHoldExtendsRetention": false,
      "accessPolicy": ["service:owning-request"]
    },
    {
      "id": "recordings",
      "retentionDays": 0,
      "retentionDriver": "request_ephemeral",
      "legalHoldExtendsRetention": false,
      "accessPolicy": ["service:owning-request"]
    },
    {
      "id": "dcc-artifacts",
      "retentionDays": 365,
      "retentionDriver": "creation_timestamp",
      "legalHoldExtendsRetention": true,
      "accessPolicy": ["subject:self", "operator:assigned-tenant"]
    },
    {
      "id": "schedules",
      "retentionDays": 30,
      "retentionDriver": "last_access_timestamp",
      "legalHoldExtendsRetention": false,
      "accessPolicy": ["subject:self"]
    },
    {
      "id": "watchers",
      "retentionDays": 30,
      "retentionDriver": "last_access_timestamp",
      "legalHoldExtendsRetention": false,
      "accessPolicy": ["subject:self"]
    },
    {
      "id": "notifications",
      "retentionDays": 30,
      "retentionDriver": "last_access_timestamp",
      "legalHoldExtendsRetention": false,
      "accessPolicy": ["subject:self"]
    },
    {
      "id": "channels",
      "retentionDays": null,
      "retentionDriver": "account_lifecycle",
      "legalHoldExtendsRetention": false,
      "accessPolicy": ["subject:self"]
    },
    {
      "id": "traces",
      "retentionDays": 2555,
      "retentionDriver": "compliance_window",
      "legalHoldExtendsRetention": true,
      "accessPolicy": ["platform-operator:admin:*", "privacy-engineering:break-glass"]
    },
    {
      "id": "eval-datasets",
      "retentionDays": null,
      "retentionDriver": "source_control",
      "legalHoldExtendsRetention": false,
      "accessPolicy": ["evaluation-maintainer:repository-read"]
    },
    {
      "id": "backups",
      "retentionDays": 365,
      "retentionDriver": "recovery_window",
      "legalHoldExtendsRetention": true,
      "accessPolicy": ["privacy-engineering:recovery-duty"]
    }
  ],
  "sourceBindings": [
    {
      "id": "policy-disclosure",
      "source": "apps/oshun/bff/src/admin/admin-audit-governance.ts",
      "includes": [
        "EVE_DATA_FAMILY_POLICIES",
        "ADMIN_AUDIT_OPERATOR_DISCLOSURE",
        "rawCustomerContentPermitted: false"
      ]
    },
    {
      "id": "minimized-hmac-chain",
      "source": "apps/oshun/bff/src/admin/admin-audit-events-store.ts",
      "includes": ["minimizeAdminAuditFields", "createHmac('sha256'", "verifyIntegrity"]
    },
    {
      "id": "audited-platform-access",
      "source": "apps/oshun/bff/src/routes/admin-audit-log.ts",
      "includes": [
        "audit.access.${action}",
        "await flushAuditPersistence(events)",
        "scopes.includes('admin:*')"
      ]
    },
    {
      "id": "durable-expiry",
      "source": "libs/oshun/persistence/src/durable-admin-audit-events-store.ts",
      "includes": ["async purgeExpired(", "isProtected", "ADMIN_AUDIT_INTEGRITY_PAYLOAD_KEY"]
    },
    {
      "id": "production-key-custody",
      "source": "apps/oshun/bff/src/admin/admin-audit-governance.ts",
      "includes": [
        "OSHUN_ADMIN_AUDIT_INTEGRITY_KEY",
        "at least 32 bytes",
        "integrityKeyScope: 'external-static'"
      ]
    },
    {
      "id": "retention-runtime",
      "source": "apps/oshun/bff/src/server.ts",
      "includes": [
        "isAdminAuditRetentionProtected",
        "ADMIN_AUDIT_RETENTION_DAYS",
        "admin audit retention purge completed"
      ]
    },
    {
      "id": "route-regression",
      "source": "apps/oshun/bff/src/__tests__/admin-audit-log-route.test.ts",
      "includes": [
        "discloses retention, access, minimization, and integrity posture",
        "audit.access.events.read"
      ]
    },
    {
      "id": "integrity-regression",
      "source": "apps/oshun/bff/src/admin/admin-audit-events-store.test.ts",
      "includes": ["detects payload or link tampering", "shadow store"]
    },
    {
      "id": "retention-regression",
      "source": "libs/oshun/persistence/src/durable-admin-audit-events-store.test.ts",
      "includes": ["purges only expired unprotected rows"]
    }
  ],
  "limitations": [
    {
      "id": "hydration-window-anchor",
      "statement": "The BFF hydrates a bounded recent window; a predecessor outside that window is disclosed as an external anchor and is not claimed as locally verified continuity.",
      "ownerTaskId": "14.5"
    },
    {
      "id": "key-custody-boundary",
      "statement": "HMAC evidence detects database-only edits only while the production integrity key remains separately controlled; compromise of both the database and key can permit recomputation.",
      "ownerTaskId": "14.5"
    },
    {
      "id": "attachment-lifecycle",
      "statement": "This policy does not admit attachment or generated-file permalink access; Task 14.8 owns that lifecycle and must consume these access classes.",
      "ownerTaskId": "14.8"
    }
  ]
}