orfeas_pam_dsl 0.6.0 → 0.8.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 905dfe93a7bf586dde5d0e90b43d37195ff892ad2ca51f30e13e8338bd1ea12d
-  data.tar.gz: 254859b323f8dcd16e15864571feeffc7d7f62f1a69934a824be3713a189b25f
+  metadata.gz: cbc7589ac5d89e024056bc8ba7c7cd24344accf0774d110841d7df67c063d12d
+  data.tar.gz: 513b8a259f2f1b98802152f0358bfc4d0b615aa6175e83780fc92a42fd426bbe
 SHA512:
-  metadata.gz: 0503caca59c63a12aa0beb51b2fd52947e80e78f3d7049729e300884d55920e9b6ae1056209f2948f0373597d0da82580d19497c8bc338852c46881073fe5956
-  data.tar.gz: e27154dd58c9f6a0a31f1449e28cd211e25a6d0589a80b406b45ecedbbd93bf85a5d5d599778c62df10ca210c79fdf582b572f2e954115121b73bcea44cb3c2a
+  metadata.gz: 2f4205ae19ef26ca957a28104833d26e567b1ba5ed74623393eea7e5a9a80492b5378c7952a6159edeb4a2e06de5c2ee731a719002f169c131b52898c559e1be
+  data.tar.gz: 58506a1d1c9e4106c570fcdb4513c7928b0b8f1207a97e5807f5f1b779eaf5e030c7aa78fe5d9a0093e0efffcd9a26a8f7437ca948254c862ce332ebd3e2f411

data/CHANGELOG.md

@@ -4,6 +4,40 @@ All notable changes to PAM DSL will be documented in this file.
 
 ## [Unreleased]
 
+## [0.8.0] - 2026-06-15
+
+The first release to RubyGems since 0.6.0, and the version the PAM article (Requirements
+Engineering, 2026) cites. It also contains 0.7.0 (below), which was never published.
+
+### Changed
+- **ActiveSupport is now optional.** `pam_dsl` previously declared a hard runtime dependency on `activesupport` and unconditionally `require`d it. It now loads ActiveSupport only if present and otherwise falls back to a minimal standard-library polyfill (`lib/pam_dsl/core_ext.rb`), so the gem is self-contained when used standalone (outside Rails). `activesupport` moved from a runtime to a development dependency (still exercised by the test suite). The ActiveSupport surface the gem uses is small: `Numeric` duration helpers (`.years`/`.months`/`.weeks`/`.days`, `.ago`/`.from_now`), `Time.current`, `String#underscore`/`#titleize`, and `Object#present?`.
+- The polyfill durations use a **fixed-length approximation** (30-day month, 365-day year), matching the gem's report tooling. When ActiveSupport is present its calendar-aware durations are used instead, unchanged.
+- `Reporter#format_duration` now matches `PamDsl::DURATION_CLASS` (`ActiveSupport::Duration` when available, else `Numeric`) instead of referencing `ActiveSupport::Duration` directly, so it works under both paths.
+
+### Added
+- `PAM_DSL_FORCE_POLYFILL` environment variable forces the stdlib polyfill even when ActiveSupport is installed, so both code paths can be tested.
+- Rake tasks `test:polyfill` (run the suite forcing the polyfill) and `test:both` (run it under both ActiveSupport and the polyfill). The same 425 tests pass under both paths; `test_duration_formatting` was made tolerant of the 30-day month boundary (the only assertion that differs between the calendar and fixed-length duration models).
+
+## [0.7.0] - 2026-06-02 (never published; part of 0.8.0)
+
+### Added
+- `ConsentRecord` class: full four-state lifecycle (P0 Pending, P1 Granted, P2 Expired, P3 Withdrawn) matching the formal consent state diagram (paper §4.2). `expires_at` is stored on the record at grant time so `state` derives `:expired` autonomously without external requirement lookup. `grant!` (P0→P1) and `withdraw!` (P1→P3) enforce valid transitions; P2 and P3 are absorbing.
+- `ConsentStore#request` creates a Pending record (P0); replaces absorbing records to support re-consent flow
+- `ConsentPolicy#request_consent` exposes the Pending flow at the policy level
+- `ConsentStore` class: runtime consent state store (the $CS$ component of the formal runtime context); indexed by `[purpose, subject]` pairs; supports `grant`, `withdraw`, `record_for`, `granted?`
+- `ConsentPolicy#grant_consent(purpose:, subject:, granted_at:)` and `#withdraw_consent(purpose:, subject:)` for populating the consent store
+- `ConsentPolicy#validate!(purpose, subject:)` now performs per-subject consent lookup against the store, implementing `consent_active(u, s, C)` from Definition 5
+- `Policy#validate_access!` signature changed to `(field_names, purpose_name, subject:)` — subject identifier is now required, eliminating the caller-supplied boolean anti-pattern
+- `UndeclaredPurposeError` and `PurposeFieldMismatchError` exception classes — completes the five-class violation taxonomy from Definition 4 (`InvalidFieldError`, `UndeclaredPurposeError`, `PurposeFieldMismatchError`, `ConsentRequiredError`, `SensitivityViolationError`)
+- `Policy#validate_access!` now calls `get_field` before `allowed?` so undeclared fields raise `InvalidFieldError` and purpose-field mismatches raise `PurposeFieldMismatchError`, making violation classes unambiguous
+- `Purpose#lia_documented!` DSL method and `lia_documented?` predicate — records that a Legitimate Interests Assessment has been conducted for an Art. 6(1)(f) purpose
+- `Policy#lia_compliance_gaps` — returns all `:legitimate_interests` purposes lacking a documented LIA; surfaces Definition 2's basis_ok condition as a compliance query rather than an enforcement gate (per paper §3.2: LIA is a human-judgment obligation, not automatable)
+- `Purpose#art9_basis(*bases)` DSL method for declaring GDPR Art. 9(2) sub-clauses on a purpose; multiple calls accumulate
+- `Purpose#art9_basis?` predicate returning true when at least one Art. 9(2) basis is declared
+- `SensitivityViolationError` exception class (Definition 4, Sensitivity Violation class)
+- `Field::SPECIAL_CATEGORY_TYPES` constant (`:health`, `:biometric`) and `Field#special_category?` predicate — identify GDPR Article 9 special-category data by **type**, independently of the `:restricted` sensitivity (Article 32 risk) level
+- `Policy#validate_access!` enforces Definition 1 Condition 5 by **data type**: raises `SensitivityViolationError` when any requested field is an Article 9 special-category type (`special_category?`) and the purpose declares no Art. 9(2) basis. This deliberately decouples the Art. 9(2) requirement from the `:restricted` risk tier, so high-risk-but-ordinary data (e.g. financial or national-identifier fields marked `:restricted`) no longer spuriously requires an Art. 9(2) basis, while a special-category type triggers the check at any sensitivity level.
+
 ## [0.6.0] - 2026-01-05
 
 ### Added

data/README.md

@@ -144,9 +144,9 @@ PamDsl.define_policy :my_policy do
   purpose :analytics do
     describe "Improving service quality and user experience"
     basis :legitimate_interests  # GDPR Article 6(1)(f)
+    lia_documented!              # balancing test conducted and on record
     requires :user_id
     optionally :session_data, :interaction_events
-    meta :balancing_test_performed, true
     meta :data_minimization, true
   end
 
@@ -166,6 +166,58 @@ end
 - `:public_task` - Task in public interest
 - `:legitimate_interests` - Legitimate interests
 
+#### Legitimate Interests Assessment (LIA)
+
+When the basis is `:legitimate_interests`, GDPR Art. 6(1)(f) requires a balancing test — a human-judgment obligation PAM cannot automate. Instead, PAM verifies that one has been recorded. Use `lia_documented!` to mark the assessment as done; `lia_compliance_gaps` surfaces any `:legitimate_interests` purposes where it is missing.
+
+```ruby
+purpose :analytics do
+  basis :legitimate_interests
+  lia_documented!   # records that the LIA balancing test has been conducted
+  requires :user_id
+end
+
+# Check which purposes still need an LIA
+policy.lia_compliance_gaps.each do |p|
+  puts "#{p.name}: LIA not documented"
+end
+```
+
+`lia_compliance_gaps` is a compliance query, not an enforcement gate — access is not blocked when `lia_documented!` is absent, because the balancing test is an organizational process, not a runtime condition.
+
+#### Art. 9(2) Basis for Special-Category Data
+
+When a purpose accesses **special-category fields** — those whose `type` is a GDPR Article 9 category (`:health`, `:biometric`) — you **must** also declare an Art. 9(2) basis. Without it, `validate_access!` raises `SensitivityViolationError`. Multiple bases are accepted. Note that this is driven by the field **type**, not by the `:restricted` sensitivity level: `:restricted` is an Article 32 *risk* tier (used for high-risk-but-ordinary data such as financial or national-identifier fields), so a `:restricted` field of a non-Article-9 type does **not** require an Art. 9(2) basis, while an Article-9-type field requires one even below `:restricted`.
+
+```ruby
+purpose :medical_diagnosis do
+  describe "Processing health data for treatment"
+  basis :contract
+  art9_basis :health_care               # Art. 9(2)(h)
+  art9_basis :explicit_consent          # Art. 9(2)(a) — multiple allowed
+  requires :diagnosis, :prescription
+end
+
+# Or pass multiple in one call
+purpose :health_research do
+  basis :public_task
+  art9_basis :health_care, :research_archiving
+  requires :diagnosis
+end
+```
+
+**Art. 9(2) Bases:**
+- `:explicit_consent` - 9(2)(a): explicit consent from the data subject
+- `:employment_law` - 9(2)(b): employment / social security law obligation
+- `:vital_interests` - 9(2)(c): vital interests, subject incapable of consenting
+- `:non_profit` - 9(2)(d): legitimate non-profit body, members only
+- `:made_public` - 9(2)(e): data manifestly made public by the subject
+- `:legal_claims` - 9(2)(f): legal claims or judicial acts
+- `:substantial_public_interest` - 9(2)(g): substantial public interest (Union/Member State law)
+- `:health_care` - 9(2)(h): medical diagnosis, health or social care
+- `:public_health` - 9(2)(i): public health
+- `:research_archiving` - 9(2)(j): scientific/historical research or statistics
+
 ### Retention Policies
 
 Define how long data should be retained:
@@ -207,7 +259,12 @@ end
 
 ### Consent Management
 
-Define consent requirements for purposes:
+Consent has two distinct layers in PAM:
+
+1. **Policy-time spec** (`consent` DSL block) — declares *what* consent is required per purpose
+2. **Runtime consent store** — records *whether* each data subject has actually granted or withdrawn consent
+
+#### Policy-time spec
 
 ```ruby
 PamDsl.define_policy :my_policy do
@@ -229,6 +286,41 @@ PamDsl.define_policy :my_policy do
 end
 ```
 
+#### Runtime consent store
+
+Before calling `validate_access!` for a consent-based purpose, populate the store with the subject's actual consent decision. The store is the runtime $CS$ component from the formal model — indexed by `(purpose, subject)` pairs.
+
+```ruby
+policy = PamDsl.policy(:my_policy)
+
+# Subject 42 grants marketing consent
+policy.consent_policy.grant_consent(purpose: :marketing, subject: 42)
+
+# Subject 42 grants with a backdated timestamp (e.g. loaded from DB)
+policy.consent_policy.grant_consent(
+  purpose: :marketing,
+  subject: 42,
+  granted_at: 6.months.ago
+)
+
+# Subject 42 withdraws consent
+policy.consent_policy.withdraw_consent(purpose: :marketing, subject: 42)
+```
+
+`validate_access!` then looks up the store automatically — no need to pass a boolean:
+
+```ruby
+# Passes: record exists and is not withdrawn/expired
+policy.validate_access!([:email], :marketing, subject: 42)
+
+# Raises ConsentRequiredError: no record for subject 99
+policy.validate_access!([:email], :marketing, subject: 99)
+
+# Raises ConsentRequiredError: record is withdrawn
+policy.consent_policy.withdraw_consent(purpose: :marketing, subject: 42)
+policy.validate_access!([:email], :marketing, subject: 42)
+```
+
 ### Custom Attributes (Metadata)
 
 PAM DSL supports custom attributes via the `meta(key, value)` method at three levels: **policy**, **field**, and **purpose**. This allows you to extend policies with application-specific data without modifying the DSL core.
@@ -244,8 +336,8 @@ PamDsl.define_policy :my_app do
   meta :dpo_email, "dpo@aegean.gr"
   meta :policy_version, "2.1"
   meta :gdpr_compliant, true
-  meta :last_review_date, "2024-01-15"
-  meta :next_review_date, "2025-01-15"
+  meta :last_review_date, "2026-06-02"
+  meta :next_review_date, "2027-06-02"
 
   # ... fields, purposes, etc.
 end
@@ -300,9 +392,9 @@ purpose :analytics do
   requires :usage_data
   optionally :device_info
 
-  # Legitimate Interest Assessment (LIA) documentation
-  meta :lia_conducted, true
-  meta :lia_date, "2024-01-15"
+  # Legitimate Interest Assessment (LIA) — use lia_documented! to record completion
+  lia_documented!
+  meta :lia_date, "2026-06-02"
   meta :lia_outcome, "Approved - minimal privacy impact"
   meta :balancing_test, "User benefit outweighs minimal data use"
 
@@ -369,16 +461,16 @@ policy = PamDsl.policy(:user_data)
 policy.allowed?(:email, :marketing)  # => true
 policy.allowed?(:ssn, :marketing)    # => false
 
-# Validate data access
+# Record consent for subject before validating (required for consent-based purposes)
+policy.consent_policy.grant_consent(purpose: :marketing, subject: current_user.id)
+
+# Validate data access — subject: is always required
 begin
-  policy.validate_access!(
-    [:email, :name],
-    :marketing,
-    consent_granted: true,
-    consent_granted_at: 6.months.ago
-  )
+  policy.validate_access!([:email, :name], :marketing, subject: current_user.id)
 rescue PamDsl::ConsentRequiredError => e
   puts "Consent error: #{e.message}"
+rescue PamDsl::SensitivityViolationError => e
+  puts "Art. 9 violation: #{e.message}"
 end
 
 # Get field and apply transformation
@@ -874,7 +966,7 @@ The `GDPRCompliance` class provides comprehensive GDPR data subject rights funct
 compliance = PamDsl::GDPRCompliance.new(
   subject_id: user.id,
   subject_type: 'User',
-  event_reader: ->(subject_id, subject_type) {
+  record_reader: ->(subject_id, subject_type) {
     # Return events for this subject from your event store
     EventStore.events_for_user(subject_id)
   }
@@ -906,7 +998,7 @@ For non-standard event formats, provide custom extractors:
 # RubyEventStore example
 compliance = PamDsl::GDPRCompliance.new(
   subject_id: user.id,
-  event_reader: ->(sid, stype) {
+  record_reader: ->(sid, stype) {
     event_store.read.stream("User$#{sid}").to_a
   },
   attribute_extractor: ->(e) { e.data[:attributes] || {} },
@@ -1069,7 +1161,9 @@ end
 - `consent(&block)` - Configure consent
 - `meta(key, value)` - Add custom metadata to policy
 - `allowed?(field, purpose)` - Check if field is allowed for purpose
-- `validate_access!(fields, purpose, consent_granted:, consent_granted_at:)` - Validate access
+- `validate_access!(fields, purpose, subject:)` - Validate access for a data subject; raises `ConsentRequiredError`, `SensitivityViolationError`, or `InvalidFieldError`
+- `consent_policy` - Access the `ConsentPolicy` to populate the runtime consent store
+- `lia_compliance_gaps` - Returns purposes with `:legitimate_interests` basis that have not called `lia_documented!`
 - `sensitive_fields` - Get all fields with confidential/restricted sensitivity
 - `restricted_fields` - Get all fields with restricted sensitivity
 - `metadata` - Access policy metadata hash
@@ -1089,12 +1183,17 @@ end
 ### Purpose
 
 - `describe(text)` - Set description
-- `basis(legal_basis)` - Set legal basis
+- `basis(legal_basis)` - Set legal basis (GDPR Art. 6)
+- `lia_documented!(value = true)` - Record that a Legitimate Interests Assessment has been conducted for this `:legitimate_interests` purpose; pass `false` to unset
+- `lia_documented?` - True when LIA has been recorded
+- `art9_basis(*bases)` - Declare one or more Art. 9(2) bases; required when the purpose accesses Article-9 special-category-**type** fields (e.g. `:health`, `:biometric`), independently of the `:restricted` risk level; multiple calls accumulate
 - `requires(*fields)` - Define required fields
 - `optionally(*fields)` - Define optional fields
 - `meta(key, value)` - Add custom metadata
 - `metadata` - Access purpose metadata hash
 - `requires_consent?` - Check if purpose requires consent (basis is :consent)
+- `art9_basis?` - True when at least one Art. 9(2) basis is declared
+- `art9_bases` - Array of declared Art. 9(2) bases
 - `all_fields` - Get all fields (required + optional)
 - `requires_field?(field)` - Check if field is required
 - `allows_field?(field)` - Check if field is allowed
@@ -1107,13 +1206,37 @@ end
 - `field(name, duration:)` - Set field retention
 - `on_expiry(strategy)` - Set deletion strategy
 
-### Consent
+### ConsentPolicy
 
-- `for_purpose(purpose, &block)` - Define consent requirement
+DSL configuration (policy-time):
+- `for_purpose(purpose, &block)` - Declare a consent requirement for a purpose
 - `required!(value)` - Set if required
 - `granular!(value)` - Enable granular consent
 - `withdrawable!(value)` - Set if withdrawable
-- `expires_in(duration)` - Set expiration
+- `expires_in(duration)` - Set expiration window
+
+Runtime consent store (per-subject, accessed via `policy.consent_policy`):
+- `grant_consent(purpose:, subject:, granted_at: Time.current)` - Record that subject granted consent
+- `withdraw_consent(purpose:, subject:)` - Record that subject withdrew consent
+- `requirement_for(purpose)` - Look up the `ConsentRequirement` for a purpose
+- `required_for?(purpose)` - True if consent is required for the purpose
+- `store` - The underlying `ConsentStore`
+
+### ConsentStore
+
+- `grant(purpose:, subject:, granted_at:)` - Add a consent record to CS
+- `withdraw(purpose:, subject:)` - Mark a record as withdrawn
+- `record_for(purpose, subject)` - Returns the `ConsentRecord` or nil
+- `granted?(purpose, subject)` - True when a non-withdrawn record exists
+
+### ConsentRecord
+
+- `purpose` - Purpose symbol
+- `subject` - Subject identifier
+- `granted_at` - Time consent was granted
+- `withdrawn_at` - Time consent was withdrawn, or nil
+- `withdrawn?` - True if consent has been withdrawn
+- `state` - `:granted` or `:withdrawn`
 
 ### Reporter
 
@@ -1155,7 +1278,7 @@ end
 
 ### GDPRCompliance
 
-- `GDPRCompliance.new(subject_id:, subject_type:, event_reader:, **extractors)` - Create compliance handler
+- `GDPRCompliance.new(subject_id:, subject_type:, record_reader:, **extractors)` - Create compliance handler
 - `data_export` - Right to Access (Art. 15) - Full data export
 - `right_to_be_forgotten_report` - Right to Erasure (Art. 17) - Deletion analysis
 - `portable_export(format:)` - Right to Portability (Art. 20) - Export as JSON/CSV/XML
@@ -1304,12 +1427,16 @@ The following table shows the default sensitivity assignments in PAM DSL:
 
 ### Legal Bases by Sensitivity
 
-| Sensitivity | Typical Legal Bases | GDPR Articles |
+`sensitivity` is an Article 32 **risk** tier; it determines the strength of protection, not the legal basis. The Article 9(2) requirement is driven separately by a field's **type** (see below), not by its sensitivity level.
+
+| Sensitivity (risk tier) | Typical Article 6 Legal Bases | GDPR Articles |
 |-------------|---------------------|---------------|
 | `:public` | Not applicable | N/A |
 | `:internal` | Contract, Legitimate Interest | Art. 6(1)(b), (f) |
 | `:confidential` | Contract, Consent, Legal Obligation | Art. 6(1)(a), (b), (c) |
-| `:restricted` | Explicit Consent + Art. 9(2) exception | Art. 9(2)(a)-(j) |
+| `:restricted` | Contract, Legal Obligation, Consent (highest-risk ordinary data, e.g. financial/national-ID) | Art. 6(1)(a), (b), (c) |
+
+**Article 9 special categories** (independent of the table above): a field whose **type** is `:health` or `:biometric` additionally requires an `art9_basis` on every purpose that accesses it — at any sensitivity level — under Art. 9(2)(a)–(j).
 
 ### Practical Implementation
 
@@ -1329,15 +1456,22 @@ PamDsl.define_policy :gdpr_compliant do
     meta :retention_period, "Account lifetime + 2 years"
   end
 
-  # Restricted - special category data
+  # Special-category TYPE (Art. 9) at the restricted risk tier
   field :health_status, type: :health, sensitivity: :restricted do
     allow_for :medical_services
-    meta :gdpr_basis, "Art. 9(2)(a) - Explicit consent"
     meta :dpia_required, true
     meta :encryption_algorithm, "AES-256"
     meta :access_approval_required, true
   end
 
+  purpose :medical_services do
+    describe "Health data processing for care provision"
+    basis :contract
+    art9_basis :health_care        # Art. 9(2)(h) — mandatory for Art. 9 type fields (:health/:biometric)
+    art9_basis :explicit_consent   # Art. 9(2)(a) — additional basis
+    requires :health_status
+  end
+
   # Restricted - financial identifier
   field :vat_number, type: :identifier, sensitivity: :restricted do
     allow_for :invoicing, :tax_compliance

data/Rakefile

@@ -8,4 +8,23 @@ Rake::TestTask.new(:test) do |t|
   t.verbose = true
 end
 
+# Same suite, forcing the ActiveSupport-free stdlib polyfill (lib/pam_dsl/core_ext.rb).
+desc "Run the test suite forcing the ActiveSupport-free polyfill path"
+task "test:polyfill" do
+  sh({ "PAM_DSL_FORCE_POLYFILL" => "1" },
+     RbConfig.ruby, "-Ilib", "-Itest",
+     "-e", 'Dir.glob("test/**/*_test.rb").sort.each { |f| require File.expand_path(f) }')
+end
+
+# Run the whole suite twice: once with ActiveSupport, once with the polyfill.
+desc "Run the test suite under BOTH ActiveSupport and the polyfill"
+task "test:both" => :test do
+  Rake::Task["test:polyfill"].invoke
+end
+
+desc "Run the validation microbenchmark (QUICK=1 for a fast sweep)"
+task :bench do
+  ruby "-Ilib", "benchmark/validation_benchmark.rb"
+end
+
 task default: :test

data/lib/pam_dsl/consent.rb

@@ -1,4 +1,110 @@
 module PamDsl
+  # Runtime consent record for a single (purpose, subject) pair — one entry in CS.
+  #
+  # Implements the four-state lifecycle from the formal model (paper §4.2, Fig. consent-cpn):
+  #   P0 Pending  — consent requested, not yet granted
+  #   P1 Granted  — consent active; data processing permitted
+  #   P2 Expired  — consent passed its expiry time (absorbing)
+  #   P3 Withdrawn — subject revoked consent (absorbing)
+  #
+  # Transitions:
+  #   t1 grant    — P0 → P1, fires on subject approval
+  #   t2 expire   — P1 → P2, guard [now >= expires_at] (evaluated lazily in #state)
+  #   t3 withdraw — P1 → P3, fires on explicit revocation
+  #
+  # Re-consent after P2 or P3 requires a new record entering P0.
+  class ConsentRecord
+    attr_reader :purpose, :subject, :granted_at, :withdrawn_at, :expires_at
+
+    def initialize(purpose:, subject:)
+      @purpose      = purpose.to_sym
+      @subject      = subject
+      @internal     = :pending
+      @granted_at   = nil
+      @withdrawn_at = nil
+      @expires_at   = nil
+    end
+
+    # t1: P0 → P1
+    def grant!(granted_at: Time.current, expires_at: nil)
+      unless @internal == :pending
+        raise Error, "Cannot grant: consent for (#{@purpose}, #{@subject}) is in state '#{state}'"
+      end
+      @granted_at = granted_at
+      @expires_at = expires_at
+      @internal   = :granted
+    end
+
+    # t3: P1 → P3 (absorbing)
+    def withdraw!(at: Time.current)
+      unless state == :granted
+        raise Error, "Cannot withdraw: consent for (#{@purpose}, #{@subject}) is in state '#{state}'"
+      end
+      @withdrawn_at = at
+      @internal     = :withdrawn
+    end
+
+    # Derives the current state, applying the t2 expiry guard lazily (paper: [now >= t_exp])
+    def state
+      return @internal unless @internal == :granted
+      return :expired if @expires_at && Time.current >= @expires_at
+      :granted
+    end
+
+    def pending?;   state == :pending;   end
+    def granted?;   state == :granted;   end
+    def expired?;   state == :expired;   end
+    def withdrawn?; state == :withdrawn; end
+  end
+
+  # Runtime consent state store — the CS component of the formal runtime context C.
+  # Indexed by [purpose, subject] pairs.
+  class ConsentStore
+    def initialize
+      @records = {}
+    end
+
+    # Create a Pending record (P0) for (purpose, subject).
+    # Replaces an absorbing record (Expired/Withdrawn) to model re-consent entering P0.
+    # Raises if an active (Pending/Granted) record already exists.
+    def request(purpose:, subject:)
+      key = [purpose.to_sym, subject]
+      existing = @records[key]
+      if existing && %i[pending granted].include?(existing.state)
+        raise Error,
+          "Cannot request consent: record for (#{purpose}, #{subject}) already in state '#{existing.state}'"
+      end
+      @records[key] = ConsentRecord.new(purpose: purpose, subject: subject)
+    end
+
+    # Grant consent (t1). Transitions an existing Pending record, or creates one and grants it
+    # immediately when no prior record exists (convenience shortcut for the common case).
+    def grant(purpose:, subject:, granted_at: Time.current, expires_at: nil)
+      key = [purpose.to_sym, subject]
+      record = @records[key]
+      if record&.state == :pending
+        record.grant!(granted_at: granted_at, expires_at: expires_at)
+      else
+        fresh = ConsentRecord.new(purpose: purpose, subject: subject)
+        fresh.grant!(granted_at: granted_at, expires_at: expires_at)
+        @records[key] = fresh
+      end
+    end
+
+    # Withdraw consent (t3). No-op if no record exists.
+    def withdraw(purpose:, subject:)
+      @records[[purpose.to_sym, subject]]&.withdraw!
+    end
+
+    def record_for(purpose, subject)
+      @records[[purpose.to_sym, subject]]
+    end
+
+    def granted?(purpose, subject)
+      record_for(purpose, subject)&.state == :granted
+    end
+  end
+
   # Represents a consent requirement
   class ConsentRequirement
     attr_reader :purpose, :required, :granular, :withdrawable, :description, :expires_after
@@ -64,15 +170,16 @@ module PamDsl
     end
   end
 
-  # Container for consent requirements
+  # Container for consent requirements (policy-time spec) and the runtime consent store (CS).
   class ConsentPolicy
-    attr_reader :requirements
+    attr_reader :requirements, :store
 
     def initialize
       @requirements = []
+      @store = ConsentStore.new
     end
 
-    # Define consent requirement for a purpose
+    # DSL: declare consent requirement for a purpose
     def for_purpose(purpose, &block)
       requirement = ConsentRequirement.new(purpose)
       requirement.instance_eval(&block) if block_given?
@@ -80,28 +187,51 @@ module PamDsl
       requirement
     end
 
-    # Get consent requirement for a purpose
+    # Runtime: create a Pending record — call before grant_consent when you need to
+    # track that a consent request was sent to the subject (P0 state)
+    def request_consent(purpose:, subject:)
+      @store.request(purpose: purpose, subject: subject)
+    end
+
+    # Runtime: grant consent for (purpose, subject), computing expires_at from the
+    # requirement's expires_after so the record can derive its own Expired state
+    def grant_consent(purpose:, subject:, granted_at: Time.current)
+      req = requirement_for(purpose)
+      expires_at = req&.expires_after ? granted_at + req.expires_after : nil
+      @store.grant(purpose: purpose, subject: subject, granted_at: granted_at, expires_at: expires_at)
+    end
+
+    # Runtime: withdraw consent for (purpose, subject) — transitions to Withdrawn (P3)
+    def withdraw_consent(purpose:, subject:)
+      @store.withdraw(purpose: purpose, subject: subject)
+    end
+
     def requirement_for(purpose)
       @requirements.find { |req| req.purpose == purpose.to_sym }
     end
 
-    # Check if consent is required for a purpose
     def required_for?(purpose)
       requirement = requirement_for(purpose)
       requirement ? requirement.required? : false
     end
 
-    # Validate consent for a purpose
-    def validate!(purpose, granted_at: nil, granted: false)
+    # Validate consent for (purpose, subject) — implements consent_active(u, s, C) from Def. 5.
+    # consent_active holds iff (u,s) ∈ CS and state(u,s) = Granted.
+    def validate!(purpose, subject:)
       requirement = requirement_for(purpose)
       return true unless requirement&.required?
 
-      unless granted
-        raise ConsentRequiredError, "Consent required for purpose: #{purpose}"
-      end
-
-      if granted_at && requirement.expired?(granted_at)
-        raise ConsentRequiredError, "Consent expired for purpose: #{purpose}"
+      current_state = @store.record_for(purpose, subject)&.state
+
+      unless current_state == :granted
+        reason = case current_state
+                 when :pending   then "consent requested but not yet granted"
+                 when :expired   then "consent has expired"
+                 when :withdrawn then "consent has been withdrawn"
+                 else                 "no consent record found"
+                 end
+        raise ConsentRequiredError,
+          "Consent not active for purpose '#{purpose}', subject '#{subject}': #{reason}"
       end
 
       true

data/lib/pam_dsl/core_ext.rb

@@ -0,0 +1,67 @@
+# frozen_string_literal: true
+
+# Minimal standard-library polyfills for the small subset of ActiveSupport that
+# pam_dsl uses. Loaded only when ActiveSupport is not available (see pam_dsl.rb),
+# so the gem runs with no external dependencies when used standalone.
+#
+# Durations use a FIXED-LENGTH approximation: 1 minute = 60 s, 1 hour = 3600 s,
+# 1 day = 86 400 s, 1 week = 7 days, 1 month = 30 days, 1 year = 365 days. This is
+# the same approximation the gem's report tooling assumes. If exact calendar
+# arithmetic is required (e.g. leap years, real month lengths), install
+# activesupport and pam_dsl will use it in preference to this polyfill.
+
+# Numeric duration helpers — return a number of seconds.
+class Numeric
+  def seconds = self
+  def minutes = self * 60
+  def hours   = self * 3_600
+  def days    = self * 86_400
+  def weeks   = self * 7 * 86_400
+  def months  = self * 30 * 86_400
+  def years   = self * 365 * 86_400
+  alias_method :second, :seconds
+  alias_method :minute, :minutes
+  alias_method :hour, :hours
+  alias_method :day, :days
+  alias_method :week, :weeks
+  alias_method :month, :months
+  alias_method :year, :years
+
+  def ago(time = Time.now)      = time - self
+  def from_now(time = Time.now) = time + self
+end unless 1.respond_to?(:years)
+
+class Time
+  def self.current = now
+end unless Time.respond_to?(:current)
+
+class String
+  # CamelCase / namespaced -> snake_case (matches ActiveSupport::Inflector#underscore
+  # for the simple identifiers pam_dsl applies it to).
+  def underscore
+    gsub("::", "/")
+      .gsub(/([A-Z]+)([A-Z][a-z])/, '\1_\2')
+      .gsub(/([a-z\d])([A-Z])/, '\1_\2')
+      .tr("-", "_")
+      .downcase
+  end
+
+  # snake_case / CamelCase -> "Title Case" (e.g. "fraud_detection" -> "Fraud Detection").
+  def titleize
+    underscore.tr("_", " ").gsub(/\b[a-z]/, &:upcase)
+  end
+end unless "".respond_to?(:underscore)
+
+# Object#blank?/present? — same truth table as ActiveSupport for the values
+# pam_dsl checks (nil, false, "", [], and "present" objects).
+class Object
+  def blank?
+    respond_to?(:empty?) ? !!empty? : !self
+  end
+
+  def present? = !blank?
+end unless Object.new.respond_to?(:present?)
+
+class NilClass
+  def blank? = true
+end unless nil.respond_to?(:blank?)

data/lib/pam_dsl/field.rb

@@ -11,6 +11,15 @@ module PamDsl
       :location, :identifier, :credential, :token, :payment_token, :custom
     ].freeze
 
+    # GDPR Article 9 special-category data is determined by the *kind* of data,
+    # not by a risk label: health, biometric, genetic, racial/ethnic, political,
+    # religious, trade-union, or sex-life/orientation data. Of PAM's PII_TYPES,
+    # :health and :biometric are the Article 9 categories; this set is the single
+    # place to extend should the taxonomy grow (e.g., a future :genetic type).
+    # The :restricted sensitivity *level* is an Article 32 risk tier and is
+    # deliberately independent of this set (Definition 1, Condition 5).
+    SPECIAL_CATEGORY_TYPES = [:health, :biometric].freeze
+
     def initialize(name, type:, sensitivity: :internal)
       @name = name.to_sym
       @type = type.to_sym
@@ -56,11 +65,18 @@ module PamDsl
       [:confidential, :restricted].include?(@sensitivity)
     end
 
-    # Check if field is highly restricted
+    # Check if field is highly restricted (Article 32 risk tier)
     def restricted?
       @sensitivity == :restricted
     end
 
+    # Check if field holds GDPR Article 9 special-category data (by type, not by
+    # sensitivity level). Triggers the Art. 9(2) basis requirement in Definition 1,
+    # Condition 5.
+    def special_category?
+      SPECIAL_CATEGORY_TYPES.include?(@type)
+    end
+
     private
 
     def validate!

data/lib/pam_dsl/gdpr_compliance.rb

@@ -10,7 +10,7 @@ module PamDsl
   #   compliance = PamDsl::GDPRCompliance.new(
   #     subject_id: user.id,
   #     subject_type: 'User',
-  #     event_reader: ->(sid, stype) {
+  #     record_reader: ->(sid, stype) {
   #       Lyra.config.event_store.read.to_a.select { |e| relates_to_subject?(e, sid, stype) }
   #     }
   #   )
@@ -19,7 +19,7 @@ module PamDsl
   # @example With RubyEventStore
   #   compliance = PamDsl::GDPRCompliance.new(
   #     subject_id: user.id,
-  #     event_reader: ->(sid, stype) {
+  #     record_reader: ->(sid, stype) {
   #       event_store.read.stream("User$#{sid}").to_a
   #     },
   #     attribute_extractor: ->(e) { e.data[:attributes] || {} },
@@ -33,7 +33,7 @@ module PamDsl
     #
     # @param subject_id [Object] The data subject's identifier
     # @param subject_type [String] The type/class of the subject (default: 'User')
-    # @param event_reader [Proc] Block that returns events for a subject: ->(subject_id, subject_type) { [...] }
+    # @param record_reader [Proc] Block that returns records for a subject: ->(subject_id, subject_type) { [...] }
     # @param attribute_extractor [Proc] Block to extract attributes from event: ->(event) { hash }
     # @param timestamp_extractor [Proc] Block to extract timestamp from event: ->(event) { time }
     # @param operation_extractor [Proc] Block to extract operation from event: ->(event) { :created/:updated/:destroyed }
@@ -42,11 +42,12 @@ module PamDsl
     # @param changes_extractor [Proc] Block to extract changes from event: ->(event) { hash }
     # @param retention_policy [Hash] Retention periods by model class
     #
-    def initialize(subject_id:, subject_type: 'User', event_reader:, **options)
+    def initialize(subject_id:, subject_type: 'User', record_reader:, **options)
       @subject_id = subject_id
       @subject_type = subject_type
-      @event_reader = event_reader
+      @record_reader = record_reader
       @options = options
+      @pam_policy = options[:policy_name] ? PamDsl.registry.get(options[:policy_name]) : nil
 
       # Set up extractors with sensible defaults
       @attribute_extractor = options[:attribute_extractor] || method(:default_attribute_extractor)
@@ -55,6 +56,7 @@ module PamDsl
       @model_class_extractor = options[:model_class_extractor] || method(:default_model_class_extractor)
       @model_id_extractor = options[:model_id_extractor] || method(:default_model_id_extractor)
       @changes_extractor = options[:changes_extractor] || method(:default_changes_extractor)
+      @source_extractor = options[:source_extractor] || method(:default_source_extractor)
       @retention_policy = options[:retention_policy] || default_retention_policy
     end
 
@@ -64,7 +66,7 @@ module PamDsl
     # @return [Hash] Complete data export including events, PII inventory, and lineage
     #
     def data_export
-      events = collect_all_events
+      events = collect_all_records
 
       {
         subject: { id: subject_id, type: subject_type },
@@ -82,7 +84,7 @@ module PamDsl
     # @return [Hash] Report on affected data and recommended deletion strategy
     #
     def right_to_be_forgotten_report
-      events = collect_all_events
+      events = collect_all_records
 
       {
         subject: { id: subject_id, type: subject_type },
@@ -102,7 +104,7 @@ module PamDsl
     # @return [String, Hash] Exported data in requested format
     #
     def portable_export(format: :json)
-      events = collect_all_events
+      events = collect_all_records
 
       data = {
         version: "1.0",
@@ -129,7 +131,7 @@ module PamDsl
     # @return [Array<Hash>] History of all data corrections
     #
     def rectification_history
-      events = collect_all_events
+      events = collect_all_records
 
       corrections = events.select do |event|
         extract_operation(event) == :updated && has_pii?(event)
@@ -153,17 +155,15 @@ module PamDsl
     # @return [Array<Hash>] Processing activities grouped by source
     #
     def processing_activities
-      events = collect_all_events
+      events = collect_all_records
 
-      activities = events.group_by do |event|
-        event.respond_to?(:metadata) ? (event.metadata[:source] || 'unknown') : 'unknown'
-      end
+      activities = events.group_by { |record| @source_extractor.call(record) }
 
       activities.map do |source, source_events|
         {
           source: source,
           purpose: infer_purpose(source, source_events),
-          legal_basis: determine_legal_basis(source_events),
+          legal_basis: determine_legal_basis(source, source_events),
           data_categories: categorize_data(source_events),
           recipients: identify_recipients(source_events),
           retention_period: determine_retention_period(source_events),
@@ -178,7 +178,7 @@ module PamDsl
     # @return [Array<Hash>] Compliance status per model class
     #
     def retention_compliance_check
-      events = collect_all_events
+      events = collect_all_records
 
       events.group_by { |e| extract_model_class(e) }.map do |model_class, model_events|
         policy = @retention_policy[model_class] || @retention_policy[:default] || { duration: 7.years }
@@ -204,7 +204,7 @@ module PamDsl
     # @return [Hash] Current consents, history, and processing legitimacy
     #
     def consent_audit
-      events = collect_all_events
+      events = collect_all_records
 
       consent_events = events.select do |event|
         data = event.respond_to?(:data) ? event.data : {}
@@ -251,11 +251,21 @@ module PamDsl
     private
 
     # Collect all events for the subject
-    def collect_all_events
-      @event_reader.call(subject_id, subject_type)
+    def collect_all_records
+      @record_reader.call(subject_id, subject_type)
+    end
+
+    # Default extractors that work with common record/event structures
+    def default_source_extractor(record)
+      if record.respond_to?(:metadata)
+        record.metadata[:source] || 'unknown'
+      elsif record.is_a?(Hash)
+        (record[:source] || record["source"] || 'unknown').to_s
+      else
+        'unknown'
+      end
     end
 
-    # Default extractors that work with common event structures
     def default_attribute_extractor(event)
       return event.attributes if event.respond_to?(:attributes) && !event.attributes.is_a?(Method)
       return event.data[:attributes] || event.data["attributes"] || {} if event.respond_to?(:data)
@@ -446,8 +456,24 @@ module PamDsl
       end
     end
 
-    def determine_legal_basis(events)
-      "Consent" # Could be: Consent, Contract, Legal obligation, Vital interests, Public task, Legitimate interests
+    LEGAL_BASIS_LABELS = {
+      consent:              "Consent (Art. 6(1)(a))",
+      contract:             "Contract (Art. 6(1)(b))",
+      legal_obligation:     "Legal obligation (Art. 6(1)(c))",
+      vital_interests:      "Vital interests (Art. 6(1)(d))",
+      public_task:          "Public task (Art. 6(1)(e))",
+      legitimate_interests: "Legitimate interests (Art. 6(1)(f))"
+    }.freeze
+
+    def determine_legal_basis(source, _events)
+      return "Not specified" unless @pam_policy
+
+      purpose = @pam_policy.purposes.values.find { |p| source_matches_purpose?(source, p) }
+      LEGAL_BASIS_LABELS[purpose&.legal_basis] || "Not specified"
+    end
+
+    def source_matches_purpose?(source, purpose)
+      source.to_s.downcase.include?(purpose.name.to_s.downcase.tr('_', ' ').split.first)
     end
 
     def categorize_data(events)

data/lib/pam_dsl/pii_masker.rb

@@ -34,6 +34,7 @@ module PamDsl
       # @return [Hash] New hash with PII fields masked
       #
       def mask(attributes, strategy: :partial)
+        raise ArgumentError, "Unknown strategy #{strategy.inspect}. Must be one of: #{STRATEGIES.join(', ')}" unless STRATEGIES.include?(strategy)
         return attributes if attributes.nil? || attributes.empty?
 
         masked = attributes.dup

data/lib/pam_dsl/policy.rb

@@ -53,48 +53,74 @@ module PamDsl
 
     # Get a purpose by name
     def get_purpose(name)
-      @purposes[name.to_sym] || raise(Error, "Purpose '#{name}' not defined in policy '#{@name}'")
+      @purposes[name.to_sym] || raise(UndeclaredPurposeError, "Purpose '#{name}' not defined in policy '#{@name}'")
     end
 
-    # Check if field is allowed for purpose
+    # Check if field is allowed for purpose.
+    #
+    # The two declaration notations are equivalent (paper §3.2): `allow_for :p` on a field
+    # and listing the field under `requires`/`optionally` on the purpose are alternative
+    # entry points to the same constraint. When the field carries an explicit allow_for
+    # declaration, either side is sufficient. When the field has no allow_for declarations
+    # it imposes no restriction and the purpose-side declaration is authoritative.
     def allowed?(field_name, purpose_name)
       field = @fields[field_name.to_sym]
       purpose = @purposes[purpose_name.to_sym]
 
       return false unless field && purpose
 
-      # Check if field allows this purpose
-      return false unless field.allowed_for?(purpose_name)
-
-      # Check if purpose allows this field
-      return false unless purpose.allows_field?(field_name)
-
-      true
+      if field.purposes.empty?
+        purpose.allows_field?(field_name)
+      else
+        field.purposes.include?(purpose_name.to_sym) || purpose.allows_field?(field_name)
+      end
     end
 
-    # Validate data access
-    def validate_access!(field_names, purpose_name, consent_granted: false, consent_granted_at: nil)
+    # Validate data access for a (fields, purpose, subject) triple — Def. 1.
+    def validate_access!(field_names, purpose_name, subject:)
       purpose = get_purpose(purpose_name)
 
-      # Check consent if required
+      # Condition 4 (Def. 1): legal basis satisfied — consent check delegates to CS
       if purpose.requires_consent?
-        @consent_policy.validate!(
-          purpose_name,
-          granted: consent_granted,
-          granted_at: consent_granted_at
-        )
+        @consent_policy.validate!(purpose_name, subject: subject)
       end
 
-      # Check if all fields are allowed for this purpose
+      # Check each field: existence first (InvalidFieldError), then membership (PurposeFieldMismatchError)
       field_names.each do |field_name|
+        get_field(field_name)
         unless allowed?(field_name, purpose_name)
-          raise Error, "Field '#{field_name}' not allowed for purpose '#{purpose_name}'"
+          raise PurposeFieldMismatchError, "Field '#{field_name}' not allowed for purpose '#{purpose_name}'"
         end
       end
 
+      # Condition 5 (Def. 1): special-category fields require an Art. 9(2) basis on
+      # the purpose. Special category is determined by the *type* of data (Art. 9 —
+      # health, biometric, ...), independently of the :restricted sensitivity *level*
+      # (an Art. 32 risk tier). High-risk-but-ordinary data such as tax or bank
+      # identifiers may be :restricted without demanding an Art. 9(2) basis.
+      has_special_category = field_names.any? do |fn|
+        f = @fields[fn.to_sym]
+        f&.special_category?
+      end
+
+      if has_special_category && !purpose.art9_basis?
+        raise SensitivityViolationError,
+          "Purpose '#{purpose_name}' accesses special-category (Article 9) data but declares no Art. 9(2) basis"
+      end
+
       true
     end
 
+    # Returns purposes whose legal basis is :legitimate_interests but whose LIA has not
+    # been recorded via lia_documented!. These represent compliance gaps: Art. 6(1)(f)
+    # requires a balancing test — a human-judgment obligation PAM cannot enforce at runtime
+    # but can verify has been documented (paper §3.2, Def. 2).
+    def lia_compliance_gaps
+      @purposes.values.select do |p|
+        p.legal_basis == :legitimate_interests && !p.lia_documented?
+      end
+    end
+
     # Get all sensitive fields
     def sensitive_fields
       @fields.values.select(&:sensitive?)

data/lib/pam_dsl/policy_generator.rb

@@ -116,7 +116,7 @@ module PamDsl
       billing: {
         description: "Processing payments and generating invoices",
         basis: :contract,
-        requires: [:email, :address]
+        requires: [:email, :address, :identifier, :financial, :credit_card]
       },
       legal_compliance: {
         description: "Compliance with legal and regulatory requirements",
@@ -465,40 +465,31 @@ module PamDsl
     end
 
     def generate_purposes_code(detected_fields)
-      # Determine which purposes make sense based on detected fields
-      field_names = detected_fields.keys
+      return "" if detected_fields.empty?
+
+      detected_types = detected_fields.values.map { |c| c[:type] }.uniq
+      fields_by_type = detected_fields.each_with_object(Hash.new { |h, k| h[k] = [] }) do |(name, config), h|
+        h[config[:type]] << name
+      end
 
       purposes = []
 
-      # Service delivery if we have names/emails
-      if field_names.any? { |f| f.to_s.include?("name") || f.to_s.include?("email") }
-        purposes << <<~RUBY
-            purpose :service_delivery do
-              describe "Core service delivery and functionality"
-              basis :contract
-              requires #{([:email] & field_names).map { |f| ":#{f}" }.join(", ")}
-            end
-        RUBY
-      end
+      DEFAULT_PURPOSES.each do |purpose_name, config|
+        required_types = config[:requires]
+        next unless required_types.empty? || required_types.any? { |t| detected_types.include?(t) }
 
-      # Billing if we have financial fields
-      if field_names.any? { |f| f.to_s.include?("address") || f.to_s.include?("vat") }
-        purposes << <<~RUBY
-            purpose :billing do
-              describe "Processing payments and generating invoices"
-              basis :contract
-              requires #{([:email, :address, :vat_number] & field_names).map { |f| ":#{f}" }.join(", ")}
-            end
-        RUBY
-      end
+        matching_fields = required_types.flat_map { |t| fields_by_type[t] }
+        requires_clause = matching_fields.map { |f| ":#{f}" }.join(", ")
+
+        lia_line = config[:basis] == :legitimate_interests \
+          ? "# lia_documented!  # uncomment after conducting the LIA balancing test\n              " \
+          : ""
 
-      # Audit trail if we have IP address
-      if field_names.include?(:ip_address)
         purposes << <<~RUBY
-            purpose :audit_trail do
-              describe "Maintaining security and audit logs"
-              basis :legal_obligation
-              requires :ip_address
+            purpose :#{purpose_name} do
+              describe "#{config[:description]}"
+              basis :#{config[:basis]}
+              #{lia_line}#{"requires #{requires_clause}" unless requires_clause.empty?}
             end
         RUBY
       end

data/lib/pam_dsl/purpose.rb

@@ -1,7 +1,21 @@
 module PamDsl
   # Represents a processing purpose
   class Purpose
-    attr_reader :name, :description, :legal_basis, :required_fields, :optional_fields, :metadata
+    attr_reader :name, :description, :legal_basis, :art9_bases, :required_fields, :optional_fields, :metadata
+
+    # Art. 9(2) sub-clauses permitting processing of special-category data
+    ART9_BASES = [
+      :explicit_consent,          # 9(2)(a) - explicit consent
+      :employment_law,            # 9(2)(b) - employment / social security law
+      :vital_interests,           # 9(2)(c) - vital interests, subject incapable of consenting
+      :non_profit,                # 9(2)(d) - legitimate non-profit body, members/former members only
+      :made_public,               # 9(2)(e) - data manifestly made public by subject
+      :legal_claims,              # 9(2)(f) - legal claims / judicial acts
+      :substantial_public_interest, # 9(2)(g) - substantial public interest (Union/Member State law)
+      :health_care,               # 9(2)(h) - medical diagnosis, health/social care
+      :public_health,             # 9(2)(i) - public health
+      :research_archiving         # 9(2)(j) - scientific/historical research, statistics
+    ].freeze
 
     LEGAL_BASES = [
       :consent,              # Article 6(1)(a) - Data subject has given consent
@@ -16,6 +30,8 @@ module PamDsl
       @name = name.to_sym
       @description = ""
       @legal_basis = :consent
+      @art9_bases = []
+      @lia_documented = false
       @required_fields = []
       @optional_fields = []
       @metadata = {}
@@ -37,6 +53,32 @@ module PamDsl
       self
     end
 
+    # Record that a Legitimate Interests Assessment (LIA) has been conducted and documented
+    # for this purpose (Art. 6(1)(f)). This is a human-judgment obligation — PAM cannot
+    # automate the balancing test, but it can verify that one has been recorded.
+    def lia_documented!(value = true)
+      @lia_documented = value
+      self
+    end
+
+    # True when a LIA has been recorded for this purpose
+    def lia_documented?
+      @lia_documented
+    end
+
+    # Declare one or more Art. 9(2) bases for processing special-category (restricted) data.
+    # Multiple calls accumulate; passing multiple symbols in one call is also accepted.
+    def art9_basis(*bases)
+      bases.flatten.each do |b|
+        b = b.to_sym
+        unless ART9_BASES.include?(b)
+          raise Error, "Invalid Art. 9(2) basis: #{b}. Must be one of #{ART9_BASES.join(', ')}"
+        end
+        @art9_bases << b unless @art9_bases.include?(b)
+      end
+      self
+    end
+
     # Define required fields
     def requires(*field_names)
       @required_fields.concat(field_names.map(&:to_sym))
@@ -55,6 +97,11 @@ module PamDsl
       self
     end
 
+    # True when the purpose carries at least one Art. 9(2) basis (Def. 1, Condition 5)
+    def art9_basis?
+      @art9_bases.any?
+    end
+
     # Check if purpose requires consent
     def requires_consent?
       @legal_basis == :consent

data/lib/pam_dsl/reporter.rb

@@ -665,7 +665,7 @@ module PamDsl
       return "N/A" unless duration
 
       case duration
-      when ActiveSupport::Duration
+      when DURATION_CLASS
         if duration >= 1.year
           "#{(duration / 1.year).to_i} years"
         elsif duration >= 1.month

data/lib/pam_dsl/version.rb

@@ -1,3 +1,3 @@
 module PamDsl
-  VERSION = "0.6.0"
+  VERSION = "0.8.0"
 end

data/lib/pam_dsl.rb

@@ -1,5 +1,20 @@
-require "active_support"
-require "active_support/core_ext"
+# ActiveSupport provides convenience helpers (Numeric durations, Time.current,
+# String#underscore, Object#present?). It is optional: when it is not installed
+# (e.g. pam_dsl used standalone, outside Rails) a minimal standard-library
+# polyfill is loaded instead. See pam_dsl/core_ext.rb.
+#
+# Set PAM_DSL_FORCE_POLYFILL to load the polyfill even when ActiveSupport is
+# available --- used by the test suite to exercise both code paths.
+if ENV["PAM_DSL_FORCE_POLYFILL"]
+  require_relative "pam_dsl/core_ext"
+else
+  begin
+    require "active_support"
+    require "active_support/core_ext"
+  rescue LoadError
+    require_relative "pam_dsl/core_ext"
+  end
+end
 
 require_relative "pam_dsl/version"
 require_relative "pam_dsl/pii_detector"
@@ -22,7 +37,15 @@ module PamDsl
   class Error < StandardError; end
   class PolicyNotFoundError < Error; end
   class InvalidFieldError < Error; end
+  class UndeclaredPurposeError < Error; end
+  class PurposeFieldMismatchError < Error; end
   class ConsentRequiredError < Error; end
+  class SensitivityViolationError < Error; end
+
+  # Class used to recognise duration values in case/when: ActiveSupport::Duration
+  # when ActiveSupport is loaded, otherwise plain Numeric (the polyfill represents
+  # durations as an integer number of seconds).
+  DURATION_CLASS = defined?(ActiveSupport::Duration) ? ActiveSupport::Duration : Numeric
 
   class << self
     # Rails configuration (set by Railtie)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: orfeas_pam_dsl
 version: !ruby/object:Gem::Version
-  version: 0.6.0
+  version: 0.8.0
 platform: ruby
 authors:
 - Michail Pantelelis
@@ -16,7 +16,7 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '6.0'
-  type: :runtime
+  type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
@@ -95,6 +95,7 @@ files:
 - Rakefile
 - lib/pam_dsl.rb
 - lib/pam_dsl/consent.rb
+- lib/pam_dsl/core_ext.rb
 - lib/pam_dsl/field.rb
 - lib/pam_dsl/gdpr_compliance.rb
 - lib/pam_dsl/pii_detector.rb
@@ -130,7 +131,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.3
+rubygems_version: 4.0.20
 specification_version: 4
 summary: Privacy Attribute Matrix (PAM) DSL for ORFEAS Framework
 test_files: []