tegwick 868f286c0a RISK-F-0008: operator ruling on identity in audit records

Opaque subject ids preferred, agent identifiers where possible, operator
credentials only where necessary, and policy decisions tracked to the
responsible party so minimising the record does not cost accountability.
Zone-level privacy guarantees may raise the floor later (zone-engine).

Shrinks the population the legal basis has to cover, and inverts the
accrual: each day's records now carry less that would need erasing. The
written determination and the trigger list stay outstanding, so the
escalation is partially-answered rather than closed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

2026-08-20 07:19:53 +02:00

4.6 KiB

Raw Blame History

Register

Generated by tools/register_index.py from findings/. Do not edit by hand. Last built 2026-08-20.

6 open of 9 findings; 2 notes below the floor.

Findings

ID	Finding	System	Severity	Disclosure	Escalation	Fix owner	Status	Review by
RISK-F-0008	The legal basis for retaining audit facts against an erasure request has been assumed, never established	audit-core	medium	public	required (t2, partially-answered)	risk-nexus	open	2026-11-17
RISK-F-0007	No consumer's tenant boundary is verified anywhere	estate	high	embargoed	answered (t4, assigned)	per-consumer, on request	accepted	2026-09-18
RISK-F-0006	apps-pg has no backup configured at all: R0 means no recovery	railiance-platform	high	embargoed	answered (t3, approved)	railiance-platform	open	2026-09-18
RISK-F-0005	audit-core read path applies no tenant filter; the bound is deployment, not code	audit-core	medium	embargoed	none	audit-core	open	2026-11-17
RISK-F-0004	agent-high-risk-boundary denies 6 of 17 high-risk lanes; the direct bao path is unprotected for the rest	railiance-platform	unset	unset	unset	railiance-platform	open	—
RISK-F-0004	tenant-engine events() returns the entire event log unfiltered	tenant-engine	high	embargoed	none	tenant-engine	open	2026-09-18
RISK-F-0003	ops-warden agent read-boundary does not fire on ungraded catalog lanes	ops-warden	high	embargoed	none	ops-warden	mitigated	2026-09-18
RISK-F-0002	ops-warden signs SSH certificates with no authorization decision, and its unblock is now unsafe	ops-warden	medium	embargoed	withdrawn (t6, withdrawn-hazard-window-closed)	ops-warden	open	2026-11-17
RISK-F-0001	flex-auth /v1/check authenticates no caller	flex-auth	high	public	withdrawn (t1, withdrawn-before-sending)	flex-auth	fixed	2026-08-26

Constraints

Hazards created by acting in the wrong order. Each binds another finding's remediation.

From	Binds	Severity	Constraint
RISK-F-0002	RISK-F-0001	lifted	LIFTED 2026-08-19 — flex-auth /v1/check now authenticates callers (RISK-F-0001 fixed). Enabling policy.enabled is now an availability question for ops-warden, no longer an attestation hazard.

Embargoes

Held from publication with a stated condition. A hold with no moving condition is a stall.

Finding	Since	Lifts when	Re-decided
RISK-F-0007	2026-08-19	a verification exists for at least one consumer boundary	2026-09-18
RISK-F-0006	2026-08-19	a backup exists and a restore has been demonstrated once	2026-09-18
RISK-F-0005	2026-08-19	AUDIT-WP-0008-T04 lands a tenant filter in the read path	2026-11-17
RISK-F-0004	2026-08-19	the read path filters by tenant in code	2026-09-18
RISK-F-0003	2026-08-19	the five exec_capable lanes graded under WARDEN-WP-0032-T05	2026-09-18
RISK-F-0002	2026-08-19	FLEX-WP-0015-T02 shipped and ops-warden policy.enabled true in production	2026-11-17

Notes (below the floor)

Seen, deliberately not findings. Not graded, not reviewed, not published.

ID	Note	Why below the floor
RISK-N-0003	Every defect in this register was found by reading, none by monitoring	no owner and no defect — it is an argument about where to invest detection, and the register cannot route an argument
RISK-N-0001	Noisy-neighbour behaviour is uncharacterised	no decision changes today — no tenant shares a saturating workload, and what is missing is measurement work, not a defect to route

How to read this

Severity is docs/method/severity.md; disclosure docs/method/disclosure.md; escalation docs/method/escalation.md; review dates docs/method/review.md. A constraint may be graded higher than the finding that carries it — read both.

4.6 KiB Raw Blame History