diff --git a/REGISTER.md b/REGISTER.md index 0df8299..b01e5fa 100644 --- a/REGISTER.md +++ b/REGISTER.md @@ -1,17 +1,18 @@ # Register -Generated by `tools/register_index.py` from `findings/`. Do not edit by hand. Last built 2026-08-19. +Generated by `tools/register_index.py` from `findings/`. Do not edit by hand. Last built 2026-08-20. -5 open of 8 findings; 2 notes below the floor. +6 open of 9 findings; 2 notes below the floor. ## Findings | ID | Finding | System | Severity | Disclosure | Escalation | Fix owner | Status | Review by | | --- | --- | --- | --- | --- | --- | --- | --- | --- | -| [RISK-F-0008](findings/RISK-F-0008-audit-retention-legal-basis-assumed.md) | The legal basis for retaining audit facts against an erasure request has been assumed, never established | audit-core | medium | public | **required** (t2, pending-operator) | risk-nexus | open | 2026-11-17 | +| [RISK-F-0008](findings/RISK-F-0008-audit-retention-legal-basis-assumed.md) | The legal basis for retaining audit facts against an erasure request has been assumed, never established | audit-core | medium | public | **required** (t2, partially-answered) | risk-nexus | open | 2026-11-17 | | [RISK-F-0007](findings/RISK-F-0007-unverified-tenant-boundary.md) | No consumer's tenant boundary is verified anywhere | estate | **high** | embargoed | **answered** (t4, assigned) | per-consumer, on request | accepted | 2026-09-18 | | [RISK-F-0006](findings/RISK-F-0006-apps-pg-no-backup-configured.md) | apps-pg has no backup configured at all: R0 means no recovery | railiance-platform | **high** | embargoed | **answered** (t3, approved) | railiance-platform | open | 2026-09-18 | | [RISK-F-0005](findings/RISK-F-0005-audit-core-unfiltered-read-path.md) | audit-core read path applies no tenant filter; the bound is deployment, not code | audit-core | medium | embargoed | none | audit-core | open | 2026-11-17 | +| [RISK-F-0004](findings/RISK-F-0004-agent-boundary-policy-covers-a-third-of-high-risk-lanes.md) | agent-high-risk-boundary denies 6 of 17 high-risk lanes; the direct bao path is unprotected for the rest | railiance-platform | unset | unset | unset | railiance-platform | open | — | | [RISK-F-0004](findings/RISK-F-0004-tenant-engine-unfiltered-event-read.md) | tenant-engine events() returns the entire event log unfiltered | tenant-engine | **high** | embargoed | none | tenant-engine | open | 2026-09-18 | | [RISK-F-0003](findings/RISK-F-0003-ops-warden-read-boundary-ungraded-lanes.md) | ops-warden agent read-boundary does not fire on ungraded catalog lanes | ops-warden | **high** | embargoed | none | ops-warden | mitigated | 2026-09-18 | | [RISK-F-0002](findings/RISK-F-0002-ops-warden-sign-ungated.md) | ops-warden signs SSH certificates with no authorization decision, and its unblock is now unsafe | ops-warden | medium | embargoed | **withdrawn** (t6, withdrawn-hazard-window-closed) | ops-warden | open | 2026-11-17 | diff --git a/findings/RISK-F-0008-audit-retention-legal-basis-assumed.md b/findings/RISK-F-0008-audit-retention-legal-basis-assumed.md index 32fec65..5b5d65b 100644 --- a/findings/RISK-F-0008-audit-retention-legal-basis-assumed.md +++ b/findings/RISK-F-0008-audit-retention-legal-basis-assumed.md @@ -25,7 +25,12 @@ disclosure: public publication: pending-handover escalation: required escalation_trigger: 2 -escalation_status: pending-operator +escalation_status: partially-answered +escalation_answered: "2026-08-20" +escalation_answered_by: the-custodian +escalation_act: rule +decision: "identity in audit records: opaque subject ids preferred, agent identifiers where possible, operator credentials only where necessary, policy decisions tracked to the responsible party; zone-level privacy guarantees may raise the floor" +outstanding: "the written determination of the retention basis, and the trigger list for buying an external answer" last_reviewed: "2026-08-19" review_by: "2026-11-17" graded_by: risk-nexus @@ -226,3 +231,48 @@ Every field of personal data that never enters the audit trail is a field with no erasure question. Where an opaque subject identifier would carry the same evidentiary weight as a name or an address, the identifier is strictly better, and that is a `audit-core` design choice available today at no legal cost. + +## Operator decision — 2026-08-20: minimise the identity, keep the accountability + +The custodian ruled on what goes into an audit record, which is the half of +this finding that shrinks the question rather than answering it: + +1. **Opaque subject identifiers are preferred.** Where an opaque id carries the + same evidentiary weight as a name or an address, it is the id that goes in. +2. **Agent identifiers where possible.** Agents act; attribute to the acting + agent identity rather than to a person behind it. +3. **Operator credentials only where necessary.** Not as a convenience, not as + a default — where the record genuinely requires the operator. +4. **Policy decisions are tracked to the responsible party.** Accountability is + preserved by linking a decision to who is answerable for it, not by + retaining personal data in the record itself. +5. **Zone guarantees may raise the floor.** If a zone establishes additional + privacy, pseudonymity or anonymity guarantees, those apply — the current + level is not a permanent ceiling. That work is `zone-engine`'s + (`ZONE-WP-0001`), and this finding should be re-read when a zone lands one. + +**Why this is more than a preference.** Personal data that never enters the +audit trail has no erasure question, no exemption to establish, and nothing to +argue about with a regulator. Points 1-3 shrink the population the legal basis +has to cover; point 4 is what stops that shrinking from costing accountability, +which is the usual objection to minimising an audit log. + +It also changes the shape of the accrual problem. The un-erasable set still +grows daily, but each day's records now carry less that would need erasing — +so the cost of a "no" answer falls with every event accepted under the new +rule rather than rising. + +**What is still outstanding**, and stays escalated: + +- The **written determination** of the retention basis — which ground, for + which category, for how long. `risk-nexus` owns writing it; it needs no + further authorisation and is scheduled into the next workplan. +- The **trigger list** for buying an external answer (first real person's data, + first counterparty contract requiring a stated position, first Art 17 + request). Proposed, not yet ruled on. + +The escalation is therefore `partially-answered`, not closed. `make check` will +keep listing it. + +**Routed to `audit-core` on 2026-08-20**, together with the keyed-commitment +question — which remains theirs to judge, because they know their chain.