RISK-F-0008: operator ruling on identity in audit records

Opaque subject ids preferred, agent identifiers where possible, operator
credentials only where necessary, and policy decisions tracked to the
responsible party so minimising the record does not cost accountability.
Zone-level privacy guarantees may raise the floor later (zone-engine).

Shrinks the population the legal basis has to cover, and inverts the
accrual: each day's records now carry less that would need erasing. The
written determination and the trigger list stay outstanding, so the
escalation is partially-answered rather than closed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

REGISTER.md

@@ -1,17 +1,18 @@
 # Register
 
-Generated by `tools/register_index.py` from `findings/`. Do not edit by hand. Last built 2026-08-19.
+Generated by `tools/register_index.py` from `findings/`. Do not edit by hand. Last built 2026-08-20.
 
-5 open of 8 findings; 2 notes below the floor.
+6 open of 9 findings; 2 notes below the floor.
 
 ## Findings
 
 | ID | Finding | System | Severity | Disclosure | Escalation | Fix owner | Status | Review by |
 | --- | --- | --- | --- | --- | --- | --- | --- | --- |
-| [RISK-F-0008](findings/RISK-F-0008-audit-retention-legal-basis-assumed.md) | The legal basis for retaining audit facts against an erasure request has been assumed, never established | audit-core | medium | public | **required** (t2, pending-operator) | risk-nexus | open | 2026-11-17 |
+| [RISK-F-0008](findings/RISK-F-0008-audit-retention-legal-basis-assumed.md) | The legal basis for retaining audit facts against an erasure request has been assumed, never established | audit-core | medium | public | **required** (t2, partially-answered) | risk-nexus | open | 2026-11-17 |
 | [RISK-F-0007](findings/RISK-F-0007-unverified-tenant-boundary.md) | No consumer's tenant boundary is verified anywhere | estate | **high** | embargoed | **answered** (t4, assigned) | per-consumer, on request | accepted | 2026-09-18 |
 | [RISK-F-0006](findings/RISK-F-0006-apps-pg-no-backup-configured.md) | apps-pg has no backup configured at all: R0 means no recovery | railiance-platform | **high** | embargoed | **answered** (t3, approved) | railiance-platform | open | 2026-09-18 |
 | [RISK-F-0005](findings/RISK-F-0005-audit-core-unfiltered-read-path.md) | audit-core read path applies no tenant filter; the bound is deployment, not code | audit-core | medium | embargoed | none | audit-core | open | 2026-11-17 |
+| [RISK-F-0004](findings/RISK-F-0004-agent-boundary-policy-covers-a-third-of-high-risk-lanes.md) | agent-high-risk-boundary denies 6 of 17 high-risk lanes; the direct bao path is unprotected for the rest | railiance-platform | unset | unset | unset | railiance-platform | open | — |
 | [RISK-F-0004](findings/RISK-F-0004-tenant-engine-unfiltered-event-read.md) | tenant-engine events() returns the entire event log unfiltered | tenant-engine | **high** | embargoed | none | tenant-engine | open | 2026-09-18 |
 | [RISK-F-0003](findings/RISK-F-0003-ops-warden-read-boundary-ungraded-lanes.md) | ops-warden agent read-boundary does not fire on ungraded catalog lanes | ops-warden | **high** | embargoed | none | ops-warden | mitigated | 2026-09-18 |
 | [RISK-F-0002](findings/RISK-F-0002-ops-warden-sign-ungated.md) | ops-warden signs SSH certificates with no authorization decision, and its unblock is now unsafe | ops-warden | medium | embargoed | **withdrawn** (t6, withdrawn-hazard-window-closed) | ops-warden | open | 2026-11-17 |

findings/RISK-F-0008-audit-retention-legal-basis-assumed.md

@@ -25,7 +25,12 @@ disclosure: public
 publication: pending-handover
 escalation: required
 escalation_trigger: 2
-escalation_status: pending-operator
+escalation_status: partially-answered
+escalation_answered: "2026-08-20"
+escalation_answered_by: the-custodian
+escalation_act: rule
+decision: "identity in audit records: opaque subject ids preferred, agent identifiers where possible, operator credentials only where necessary, policy decisions tracked to the responsible party; zone-level privacy guarantees may raise the floor"
+outstanding: "the written determination of the retention basis, and the trigger list for buying an external answer"
 last_reviewed: "2026-08-19"
 review_by: "2026-11-17"
 graded_by: risk-nexus
@@ -226,3 +231,48 @@ Every field of personal data that never enters the audit trail is a field with
 no erasure question. Where an opaque subject identifier would carry the same
 evidentiary weight as a name or an address, the identifier is strictly better,
 and that is a `audit-core` design choice available today at no legal cost.
+
+## Operator decision — 2026-08-20: minimise the identity, keep the accountability
+
+The custodian ruled on what goes into an audit record, which is the half of
+this finding that shrinks the question rather than answering it:
+
+1. **Opaque subject identifiers are preferred.** Where an opaque id carries the
+   same evidentiary weight as a name or an address, it is the id that goes in.
+2. **Agent identifiers where possible.** Agents act; attribute to the acting
+   agent identity rather than to a person behind it.
+3. **Operator credentials only where necessary.** Not as a convenience, not as
+   a default — where the record genuinely requires the operator.
+4. **Policy decisions are tracked to the responsible party.** Accountability is
+   preserved by linking a decision to who is answerable for it, not by
+   retaining personal data in the record itself.
+5. **Zone guarantees may raise the floor.** If a zone establishes additional
+   privacy, pseudonymity or anonymity guarantees, those apply — the current
+   level is not a permanent ceiling. That work is `zone-engine`'s
+   (`ZONE-WP-0001`), and this finding should be re-read when a zone lands one.
+
+**Why this is more than a preference.** Personal data that never enters the
+audit trail has no erasure question, no exemption to establish, and nothing to
+argue about with a regulator. Points 1-3 shrink the population the legal basis
+has to cover; point 4 is what stops that shrinking from costing accountability,
+which is the usual objection to minimising an audit log.
+
+It also changes the shape of the accrual problem. The un-erasable set still
+grows daily, but each day's records now carry less that would need erasing —
+so the cost of a "no" answer falls with every event accepted under the new
+rule rather than rising.
+
+**What is still outstanding**, and stays escalated:
+
+- The **written determination** of the retention basis — which ground, for
+  which category, for how long. `risk-nexus` owns writing it; it needs no
+  further authorisation and is scheduled into the next workplan.
+- The **trigger list** for buying an external answer (first real person's data,
+  first counterparty contract requiring a stated position, first Art 17
+  request). Proposed, not yet ruled on.
+
+The escalation is therefore `partially-answered`, not closed. `make check` will
+keep listing it.
+
+**Routed to `audit-core` on 2026-08-20**, together with the keyed-commitment
+question — which remains theirs to judge, because they know their chain.