@wildo-ai/saas-models 1.1.5 → 1.1.6

package/dist/esm/compliance/audit-trails/security-audit-event-envelope.shared.schema.d.ts

@@ -7,6 +7,8 @@
  */
 import { z } from 'zod';
 import { AuditEventCategory, AuditEventSeverity, CoreAuditableEventType } from './auditable-events.shared.schema';
+import { AuditActorKind } from './audit-actor.shared.schemas';
+import { FactorSatisfactionSource } from '../../security/authentications/service-provider-client-authentication.shared.schemas';
 /** Outcome for SIEM envelope — success or failure. */
 export declare enum AuditEventOutcome {
     SUCCESS = "success",
@@ -30,12 +32,20 @@ export declare const SecurityAuditEventEnvelopeSchema: z.ZodObject<{
     applicationName: z.ZodOptional<z.ZodString>;
     userId: z.ZodOptional<z.ZodString>;
     userEmail: z.ZodOptional<z.ZodString>;
+    actorKind: z.ZodOptional<z.ZodEnum<typeof AuditActorKind>>;
+    agentRef: z.ZodOptional<z.ZodString>;
+    agentExecutionId: z.ZodOptional<z.ZodString>;
+    delegatingClientId: z.ZodOptional<z.ZodString>;
+    actingViaServiceProviderRelationshipId: z.ZodOptional<z.ZodString>;
+    providerOrganizationId: z.ZodOptional<z.ZodString>;
+    serviceProviderFactorSource: z.ZodOptional<z.ZodEnum<typeof FactorSatisfactionSource>>;
     sourceService: z.ZodString;
     sourceVersion: z.ZodString;
     sourceEnvironment: z.ZodString;
     authMethod: z.ZodOptional<z.ZodString>;
     authSource: z.ZodOptional<z.ZodString>;
     providerRef: z.ZodOptional<z.ZodString>;
+    connectionRef: z.ZodOptional<z.ZodString>;
     connectionType: z.ZodOptional<z.ZodString>;
     ipAddress: z.ZodOptional<z.ZodString>;
     userAgent: z.ZodOptional<z.ZodString>;

package/dist/esm/compliance/audit-trails/security-audit-event-envelope.shared.schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"security-audit-event-envelope.shared.schema.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/audit-trails/security-audit-event-envelope.shared.schema.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAGL,kBAAkB,EAClB,kBAAkB,EAClB,sBAAsB,EAEvB,MAAM,kCAAkC,CAAC;AAE1C,sDAAsD;AACtD,oBAAY,iBAAiB;IAC3B,OAAO,YAAY;IACnB,OAAO,YAAY;CACpB;AAED;;oEAEoE;AAEpE,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA4E3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F;;;;;oEAKoE;AAEpE,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,QAAQ,EAAE,kBAAkB,CAAC;CAC9B;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,8BAA8B,EAAE,MAAM,CAAC,sBAAsB,EAAE,wBAAwB,CAicnG,CAAC;AAIF;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,wBAAwB,CAEvF"}
+{"version":3,"file":"security-audit-event-envelope.shared.schema.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/audit-trails/security-audit-event-envelope.shared.schema.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAGL,kBAAkB,EAClB,kBAAkB,EAClB,sBAAsB,EAEvB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,wBAAwB,EAAE,MAAM,sFAAsF,CAAC;AAEhI,sDAAsD;AACtD,oBAAY,iBAAiB;IAC3B,OAAO,YAAY;IACnB,OAAO,YAAY;CACpB;AAED;;oEAEoE;AAEpE,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA6G3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F;;;;;oEAKoE;AAEpE,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,QAAQ,EAAE,kBAAkB,CAAC;CAC9B;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,8BAA8B,EAAE,MAAM,CAAC,sBAAsB,EAAE,wBAAwB,CA2iBnG,CAAC;AAIF;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,wBAAwB,CAEvF"}

package/dist/esm/compliance/audit-trails/security-audit-event-envelope.shared.schema.js

@@ -7,6 +7,8 @@
  */
 import { z } from 'zod';
 import { AUDIT_EVENT_CATEGORY_MEANINGS, AUDIT_EVENT_SEVERITY_MEANINGS, AuditEventCategory, AuditEventSeverity, CoreAuditableEventType, describeAuditVocabulary, } from './auditable-events.shared.schema.js';
+import { AuditActorKind } from './audit-actor.shared.schemas.js';
+import { FactorSatisfactionSource } from '../../security/authentications/service-provider-client-authentication.shared.schemas.js';
 /** Outcome for SIEM envelope — success or failure. */
 export var AuditEventOutcome;
 (function (AuditEventOutcome) {
@@ -67,6 +69,33 @@ export const SecurityAuditEventEnvelopeSchema = z.object({
     applicationName: z.string().optional(),
     userId: z.string().optional(),
     userEmail: z.string().optional(),
+    /**
+     * The KIND of principal whose authority was used (`AuditActorKind`) — lets a SIEM rule tell a person
+     * from a delegated client, a machine, or the application itself without joining back. Copied from
+     * the audit row; absent only on a row written before the field existed.
+     */
+    actorKind: z.enum(AuditActorKind).optional(),
+    /**
+     * The AI agent that performed the action (`agentActor.agentRef` on the row) — present only when an
+     * agent acted. A configuration identifier, not personal data. `actorKind` still names the principal.
+     */
+    agentRef: z.string().optional(),
+    /** The agent's conversational execution (`agentActor.agentExecutionId`) — a pseudonymous key, never transcript text. */
+    agentExecutionId: z.string().optional(),
+    /** The external OAuth client a person delegated to (the verified token's `azp`), for `actorKind = DELEGATED_CLIENT`. */
+    delegatingClientId: z.string().optional(),
+    /**
+     * The service-provider relationship the principal acted through (#1597), copied from the row. Present only
+     * on an event in a CLIENT organization caused by a firm's expert or machine client. An identifier, not personal data.
+     */
+    actingViaServiceProviderRelationshipId: z.string().optional(),
+    /** The firm behind `actingViaServiceProviderRelationshipId`; present exactly when it is. */
+    providerOrganizationId: z.string().optional(),
+    /**
+     * Where the factor that satisfied the client organization's authentication policy came from (#1633), copied from
+     * the row: this application, or the firm's trusted identity provider. A source, never a person or a proof.
+     */
+    serviceProviderFactorSource: z.enum(FactorSatisfactionSource).optional(),
     // Source
     sourceService: z.string(),
     sourceVersion: z.string(),
@@ -75,6 +104,12 @@ export const SecurityAuditEventEnvelopeSchema = z.object({
     authMethod: z.string().optional(),
     authSource: z.string().optional(),
     providerRef: z.string().optional(),
+    /**
+     * The CONNECTION a stored provider credential belongs to (#1670), copied from `eventData.connectionRef` on
+     * the credential lifecycle events. Beside `providerRef` because the two differ once several refs of one
+     * vendor share a connection (#1725): the ref says which integration acted, the connection which grant.
+     */
+    connectionRef: z.string().optional(),
     connectionType: z.string().optional(),
     ipAddress: z.string().optional(),
     userAgent: z.string().optional(),
@@ -248,6 +283,8 @@ export const AUDIT_EVENT_CLASSIFICATION_MAP = {
     // breach (ERROR). Category ORG_MANAGEMENT keeps it in the same security-configuration cluster a
     // reviewer already queries for SSO/SIEM/SCIM configuration changes.
     [CoreAuditableEventType.APPLICATION_AUTH_POLICY_CHANGED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },
+    // Routine and hourly: INFO. A failed run is marked by the row's HIGH `riskLevel`, since severity is fixed per type.
+    [CoreAuditableEventType.RETENTION_ENFORCEMENT_RECORDED]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.INFO },
     // Outbound M2M Webhook Events
     // WARNING rather than INFO, and the choice is externally grounded rather than taste — it was
     // challenged on the reasonable objection that every LEGITIMATE connectivity test then emits a
@@ -276,6 +313,34 @@ export const AUDIT_EVENT_CLASSIFICATION_MAP = {
     // default. If a deployment finds the volume genuinely noisy, tune the SIEM's review per AU-6 —
     // do not silently downgrade this to INFO.
     [CoreAuditableEventType.WEBHOOK_ENDPOINT_TEST_DISPATCHED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },
+    // Inbound deliveries (#1596) — data entering through the API. A refusal, an unroutable message, a failed
+    // attempt, a dead delivery and a replay are WARNING: each is something an operator may have to act on.
+    // DEAD is not CRITICAL: nothing is compromised, and CRITICAL is the paging floor.
+    [CoreAuditableEventType.INBOUND_DELIVERY_REJECTED]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.WARNING },
+    [CoreAuditableEventType.INBOUND_DELIVERY_ACCEPTED]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.INFO },
+    [CoreAuditableEventType.INBOUND_DELIVERY_UNROUTABLE]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.WARNING },
+    [CoreAuditableEventType.INBOUND_DELIVERY_PROCESSED]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.INFO },
+    [CoreAuditableEventType.INBOUND_DELIVERY_FAILED]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.WARNING },
+    [CoreAuditableEventType.INBOUND_DELIVERY_DEAD]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.WARNING },
+    [CoreAuditableEventType.INBOUND_DELIVERY_REPLAYED]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.WARNING },
+    // Inbound channels (#1630). A below-assurance message and a token presented by the wrong sender are WARNING —
+    // each can be the first sign of a spoofed or leaked address; a revocation and a sent reply are routine.
+    [CoreAuditableEventType.INBOUND_DELIVERY_BELOW_ASSURANCE]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.WARNING },
+    [CoreAuditableEventType.INBOUND_REPLY_SENT]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.INFO },
+    [CoreAuditableEventType.INBOUND_REPLY_FAILED]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.WARNING },
+    [CoreAuditableEventType.INBOUND_REPLY_TOKEN_REVOKED]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.INFO },
+    [CoreAuditableEventType.INBOUND_REPLY_TOKEN_DOWNGRADED]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.WARNING },
+    // #1600: a domain decides where a tenant's mail goes, so its lifecycle is organization management; losing one
+    // (suspension) and withholding an attachment are what an operator is alerted on.
+    [CoreAuditableEventType.ORGANIZATION_EMAIL_DOMAIN_CLAIMED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.INFO },
+    [CoreAuditableEventType.ORGANIZATION_EMAIL_DOMAIN_OWNERSHIP_VERIFIED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },
+    [CoreAuditableEventType.ORGANIZATION_EMAIL_DOMAIN_VERIFIED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.INFO },
+    [CoreAuditableEventType.ORGANIZATION_EMAIL_DOMAIN_SUSPENDED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },
+    [CoreAuditableEventType.ORGANIZATION_EMAIL_DOMAIN_REMOVED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },
+    [CoreAuditableEventType.CLIENT_MAILBOX_CREATED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },
+    [CoreAuditableEventType.CLIENT_MAILBOX_REMOVED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.INFO },
+    [CoreAuditableEventType.INBOUND_EMAIL_ATTACHMENT_WITHHELD]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.WARNING },
+    [CoreAuditableEventType.INBOUND_EMAIL_REJECTED_LIMIT]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.WARNING },
     // SCIM Directory Provisioning Events
     [CoreAuditableEventType.SCIM_TOKEN_CREATED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },
     [CoreAuditableEventType.SCIM_TOKEN_REVOKED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },
@@ -428,6 +493,43 @@ export const AUDIT_EVENT_CLASSIFICATION_MAP = {
     // worth escalating is `autoApprovalReason: TENANT_CANNOT_APPROVE`, which a SIEM rule selects on and
     // which the emitter additionally carries at a higher `riskLevel`.
     [CoreAuditableEventType.PLATFORM_ACCESS_GRANT_LIFECYCLE]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },
+    // A hold changes what a tenant's data may become, the way an organization configuration change does (#1634).
+    [CoreAuditableEventType.LEGAL_HOLD_PLACED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },
+    // #1598: linking an aggregate to its invoice decides how long it is kept past its tenant — a record-keeping
+    // decision on the tenant's data, routine billing traffic rather than an anomaly, so INFO.
+    [CoreAuditableEventType.MODEL_COST_AGGREGATE_INVOICE_LINKED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.INFO },
+    [CoreAuditableEventType.CORRECTION_CAPTURE_SETTING_CHANGED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },
+    [CoreAuditableEventType.EVALUATION_EXPORT_AUTHORIZATION_CHANGED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },
+    [CoreAuditableEventType.EVALUATION_DATASET_EXPORTED]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.WARNING },
+    [CoreAuditableEventType.EVALUATION_DATASET_EXPORT_REFUSED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },
+    [CoreAuditableEventType.LEGAL_HOLD_RELEASED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },
+    // AUTHORIZATION / WARNING for all four service-provider events (#1597), matching the grant: each one
+    // changes which people from OUTSIDE an organization can reach it, and a reviewer sweeping for changes
+    // in who can reach what must find them without knowing to look for them.
+    [CoreAuditableEventType.SERVICE_PROVIDER_RELATIONSHIP_LIFECYCLE]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },
+    [CoreAuditableEventType.SERVICE_PROVIDER_MACHINE_CLIENT_ADMISSION_CHANGED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },
+    [CoreAuditableEventType.SERVICE_PROVIDER_EXPERT_ASSIGNED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },
+    [CoreAuditableEventType.SERVICE_PROVIDER_EXPERT_UNASSIGNED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },
+    // The per-expert approval (#1612) decides whether one more person from outside reaches the client: the same
+    // AUTHORIZATION / WARNING as an assignment, for the same reviewer sweeping for changes in who can reach what.
+    [CoreAuditableEventType.SERVICE_PROVIDER_EXPERT_APPROVAL_REQUESTED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },
+    [CoreAuditableEventType.SERVICE_PROVIDER_EXPERT_APPROVAL_GRANTED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },
+    [CoreAuditableEventType.SERVICE_PROVIDER_EXPERT_APPROVAL_DENIED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },
+    // Trusting a firm's MFA changes what may satisfy the client's authentication policy for outside staff (#1633): the
+    // same AUTHORIZATION / WARNING a reviewer sweeping for changes in who can reach what already reads.
+    [CoreAuditableEventType.SERVICE_PROVIDER_MFA_TRUST_CHANGED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },
+    // A factor proven for a client is an authentication outcome, like a step-up (#1633).
+    [CoreAuditableEventType.SERVICE_PROVIDER_CLIENT_AUTHENTICATION_SATISFIED]: { category: AuditEventCategory.AUTHENTICATION, severity: AuditEventSeverity.INFO },
+    // The firm's worker-monitoring decision and the client's disclosure level change who learns what about people's
+    // work (#1632): configuration of an organization, WARNING so a monitoring switch is never routine noise.
+    [CoreAuditableEventType.SERVICE_PROVIDER_ACTIVITY_FEED_DECIDED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },
+    [CoreAuditableEventType.SERVICE_PROVIDER_ACTIVITY_FEED_DISCLOSURE_CHANGED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },
+    [CoreAuditableEventType.SERVICE_PROVIDER_EXPERT_APPROVAL_LAPSED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },
+    // Delegated administration (#1631) is a privilege change for people outside the organization: AUTHORIZATION, and
+    // CRITICAL — lending administration is the change a reviewer must never miss; the row's `securityCritical` and its
+    // riskLevel say which grants were owner-only.
+    [CoreAuditableEventType.SERVICE_PROVIDER_CAPABILITY_GRANTED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.CRITICAL },
+    [CoreAuditableEventType.SERVICE_PROVIDER_CAPABILITY_REVOKED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },
     // AUTHORIZATION / WARNING, matching its grant sibling exactly. The category is not a judgement
     // call: assigning a partition to a unit decides which members may read a remote company's rows, so
     // it is an access-control decision whatever it looks like from the configuration side. WARNING
@@ -451,6 +553,26 @@ export const AUDIT_EVENT_CLASSIFICATION_MAP = {
     // trail (who/which provider/which entity/how much), not an alarm. WARNING would put every
     // ordinary external read beside see-through privileged access and train reviewers to skim.
     [CoreAuditableEventType.HTTP_API_READ_THROUGH_ACCESS]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.INFO },
+    // A write THROUGH a read-through binding (#1679). INFO like its read twin: an authorized member changing
+    // a row of the company's own ERP is routine, and the value is the queryable trail. What differs per
+    // emission — applied, refused, unknown — rides `eventData.outcome` and the per-emission `riskLevel`;
+    // a static WARNING would put every ordinary remote update beside privileged see-through access.
+    [CoreAuditableEventType.HTTP_API_WRITE_THROUGH]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.INFO },
+    // A declared system-of-record ACTION ran (#1678). DATA_ACCESS/INFO like the write-through row: an authorized member
+    // posting an invoice in the company's own ERP is routine, and the per-emission `riskLevel` carries what differs —
+    // an unknown outcome is HIGH, a performed action MEDIUM.
+    [CoreAuditableEventType.SYSTEM_OF_RECORD_ACTION_EXECUTED]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.INFO },
+    // A declared system-of-record action was REFUSED before sending (#1678): a negative access decision, classified with
+    // PROVIDER_OPERATION_DENIED and RESOURCE_OPERATION_DENIED rather than with the executed row.
+    //
+    // assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT
+    [CoreAuditableEventType.SYSTEM_OF_RECORD_ACTION_REFUSED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },
+    // #1734 — an operator discarded a pipeline's pass state: administrative, like a platform configuration publication.
+    [CoreAuditableEventType.EXTERNAL_DATA_PIPELINE_RESET]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },
+    // #2039 — an operator's answer about an outbound write: administrative, like the reset beside it.
+    [CoreAuditableEventType.EXTERNAL_DATA_OUTBOUND_UNKNOWN_RESOLVED]: { category: AuditEventCategory.ORG_MANAGEMENT, severity: AuditEventSeverity.WARNING },
+    // #1723 — one side's data overwritten by a conflict resolution: data access, and worth a reviewer's look.
+    [CoreAuditableEventType.EXTERNAL_DATA_CONFLICT_RESOLVED]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.WARNING },
     // The other outbound door: a custom service calling a declared provider operation. Same reading as
     // the read-through row above — routine, authorized activity whose value is the queryable trail. The
     // READ/WRITE axis and the failure case ride `classification`, `failureKind` and the per-emission
@@ -466,18 +588,37 @@ export const AUDIT_EVENT_CLASSIFICATION_MAP = {
     // value is the queryable trail rather than an alarm. A refused target rides `failureKind`/`outcome`
     // on the payload, never the static severity — see the enum member's docstring.
     [CoreAuditableEventType.MCP_TOOL_CALL]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.INFO },
-    // A human approver AUTHORED the arguments a gated tool ran with. AUTHORIZATION rather than
-    // DATA_ACCESS because the recorded act is the DECISION, not the tool's effect — whatever the tool
-    // then touched is recorded by the tool's own operation rows. WARNING rather than CRITICAL for the
-    // same reading as the OAuth grant rows: an identified person taking an authorized action with the
-    // pause in front of them is notable, not wrong, and reserving CRITICAL for rows that mean
-    // something IS wrong is what keeps a severity filter worth reading.
-    [CoreAuditableEventType.AGENT_TOOL_APPROVAL_MODIFIED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },
+    [CoreAuditableEventType.PROVIDER_CAPABILITY_CALL]: { category: AuditEventCategory.DATA_ACCESS, severity: AuditEventSeverity.INFO },
+    // #1594 — one decision family for both planes. Each row records who may, or did, authorize an agent's
+    // action, so AUTHORIZATION throughout. INFO: an identified person acting within their route is the
+    // system working. The one WARNING is the refusal, because a refused attempt is the evidence a reviewer
+    // looks for. Modified approvals are no longer a separate WARNING type: filter RESOLVED on `outcome`.
+    [CoreAuditableEventType.HUMAN_DECISION_REQUESTED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.INFO },
+    [CoreAuditableEventType.HUMAN_DECISION_RESOLVED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.INFO },
+    [CoreAuditableEventType.HUMAN_DECISION_REASSIGNED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.INFO },
+    [CoreAuditableEventType.HUMAN_DECISION_ESCALATED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.INFO },
+    [CoreAuditableEventType.HUMAN_DECISION_CLAIMED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.INFO },
+    [CoreAuditableEventType.HUMAN_DECISION_ANSWER_REFUSED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },
+    // #1628 — a deadline only changes who is asked and who is told, never the outcome, so every row is INFO.
+    // A missed deadline is a service-level fact, not a security warning; WARNING stays for refusals.
+    [CoreAuditableEventType.HUMAN_DECISION_DEADLINE_MISSED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.INFO },
+    [CoreAuditableEventType.HUMAN_DECISION_ESCALATION_FIRED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.INFO },
+    [CoreAuditableEventType.HUMAN_DECISION_CLOCK_PAUSED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.INFO },
+    [CoreAuditableEventType.HUMAN_DECISION_CLOCK_RESUMED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.INFO },
+    // #1611 — a binding grants an agent standing authority to act unattended: AUTHORIZATION at WARNING, as a
+    // machine client's admission into a client organization is. A turn the entry point opens runs under
+    // that authority (INFO); a refused one is evidence of something unexpected (WARNING).
+    [CoreAuditableEventType.AUTONOMOUS_AGENT_BOUND]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },
+    [CoreAuditableEventType.AUTONOMOUS_AGENT_UNBOUND]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },
+    [CoreAuditableEventType.AUTONOMOUS_AGENT_TURN_STARTED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.INFO },
+    [CoreAuditableEventType.AUTONOMOUS_AGENT_TURN_REFUSED]: { category: AuditEventCategory.AUTHORIZATION, severity: AuditEventSeverity.WARNING },
     // The sanctioned mechanics of a data-protection request (D6 stance 6b) — routine, not an alarm.
     [CoreAuditableEventType.HTTP_API_EXTERNAL_ERASURE]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.INFO },
     // A deliberate, per-request erasure hole (D6 stance 6c) — the record is the control, so it must
     // surface in every severity-filtered view an operator actually reads.
     [CoreAuditableEventType.HTTP_API_NON_ERASURE_ACKNOWLEDGED]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.CRITICAL },
+    // The sanctioned mechanics of a data-protection request; the row's `status` carries whether data stayed live.
+    [CoreAuditableEventType.SUBJECT_ERASURE_RECIPIENT_OUTCOME]: { category: AuditEventCategory.USER_LIFECYCLE, severity: AuditEventSeverity.INFO },
     // OAuth2 / OIDC Provider Events (Wildo AS the authorization server). Delegated-authority grants +
     // consent decisions are AUTHORIZATION; token lifecycle (refresh/revoke) is AUTHENTICATION. Severity:
     // a third party gaining/holding user-acting access is WARNING (notable, SOC-dashboard-worthy, but an