39 lines
1.8 KiB
Markdown
39 lines
1.8 KiB
Markdown
|
---
|
||
|
|
id: RISK-N-0002
|
||
|
|
type: note
|
||
|
|
title: "Erasure duty and audit immutability have not been reconciled"
|
||
|
|
date: "2026-08-19"
|
||
|
|
source: "NetKingdom Tenancy Posture (draft), open question"
|
||
|
|
floor_reason: "no obligation exists yet — the estate holds no real person's data, so there is nothing to erase and no counterparty to owe it to"
|
||
|
|
revisit: "on the day the estate first holds a real person's data; belongs to the regulatory-intake workplan, not this one"
|
||
|
|
ruling: RISK-RULING-2026-08-19-B
|
||
|
|
---
|
||
|
|
|
||
|
|
# RISK-N-0002 — erasure versus audit
|
||
|
|
|
||
|
|
Named in `INTENT.md` as waiting: an audit trail that must be immutable and an
|
||
|
|
erasure obligation that may require destroying what is in it cannot both be
|
||
|
|
satisfied naively, and the estate has not reconciled them.
|
||
|
|
|
||
|
|
**Ruled a note, not a finding, on 2026-08-19.**
|
||
|
|
|
||
|
|
This is a real design tension and it will need a real answer — whether key
|
||
|
|
destruction satisfies an erasure obligation is exactly the question
|
||
|
|
`INTENT.md` says was researched, used once, and discarded.
|
||
|
|
|
||
|
|
It is a note today for one reason: there is no obligation. The estate holds no
|
||
|
|
real person's data, so nothing is owed to anyone. Escalation trigger 2 reads
|
||
|
|
"creates or reveals an obligation with an outside counterparty", and this
|
||
|
|
creates none yet. A finding needs a decision that changes, and today the
|
||
|
|
decision is "not yet".
|
||
|
|
|
||
|
|
It is also not shaped like this register's work. It is a regulatory question
|
||
|
|
first and an architecture question second, and `INTENT.md` puts regulatory
|
||
|
|
intake in this repo but keeps "what the estate must therefore do" with the
|
||
|
|
owning repo. Reconciling it belongs to the regulatory-intake workplan
|
||
|
|
(`RISK-WP-0001` residual), not to finding triage.
|
||
|
|
|
||
|
|
It comes back on the day the estate first holds a real person's data. That day
|
||
|
|
is also when it stops being a note, because from then on the obligation is real
|
||
|
|
and trigger 2 fires.
|