@wildo-ai/saas-models 1.1.5 → 1.1.7

package/dist/esm/compliance/audit-trails/audit-actor.shared.schemas.js

@@ -27,6 +27,7 @@
  * assurance-control: WILDO.AUDIT.ATTRIBUTION — a security-relevant action must record who performed
  * it, and must not disguise an unattributable action as an ordinary automated one.
  */
+import { z } from 'zod';
 /**
  * Sentinel actors for audit `*By` fields. Resolve one with
  * `resolveAuditActorId(executionContext)` from `@wildo-ai/saas-backend-lib` rather than choosing by
@@ -65,4 +66,90 @@ export const AUDIT_ACTOR_SENTINELS = Object.freeze(Object.values(AuditActorSenti
 export function isAuditActorSentinel(actorId) {
     return AUDIT_ACTOR_SENTINELS.includes(actorId);
 }
+/** @wildo_source:part:start saas.models.audit-trails.actor-attribution facet:layer:shared facet:family:audit-trails facet:audience:app-developer */
+/**
+ * The KIND of principal whose authority an audited action used — recorded on every audit row as
+ * `actorKind`, beside `userId`.
+ *
+ * It answers ONE question and nothing else: *under whose authority did this happen?* Whether an AI
+ * agent performed the action is a different question, answered by the presence of the row's
+ * `agentActor` ({@link AuditAgentActorSchema}). An agent is never a principal: it always acts under a
+ * user's, a machine's, or the application's own authority, so there is deliberately no `AGENT` member.
+ * Folding the two into one field would make it answer two questions and a reader could no longer tell
+ * "the user did it" from "an agent did it with the user's authority".
+ *
+ * The framework fills it on every row, so an application never writes it. An application emitting its
+ * own event through `AuditLogsBackendService.logEvent` passes its request context, and with none names
+ * the principal instead: `userAuditPrincipal(userId)`, `SYSTEM_AUDIT_PRINCIPAL`,
+ * `UNAUTHENTICATED_AUDIT_PRINCIPAL` or `machineCredentialAuditPrincipal(...)`, all exported by
+ * `@wildo-ai/saas-backend-lib`. With neither, the kind is read off the `userId` the event carries — right
+ * only when that id is the actor, not the subject.
+ *
+ * assurance-control: WILDO.AUDIT.ATTRIBUTION — every audit row names the kind of principal whose
+ * authority was used, so an unattributed action stays distinguishable from routine automation.
+ */
+export var AuditActorKind;
+(function (AuditActorKind) {
+    /** A signed-in person acting through a first-party session. `userId` is that person. */
+    AuditActorKind["USER"] = "user";
+    /**
+     * A person's authority, exercised by an EXTERNAL OAuth client they delegated to (an A2A or MCP
+     * client). `userId` is the delegating person and `delegatingClientId` names the client, taken from
+     * the verified token's `azp`.
+     */
+    AuditActorKind["DELEGATED_CLIENT"] = "delegated_client";
+    /** An organization or application machine credential (API key or OAuth client credentials). `principalCredentialId` names it. */
+    AuditActorKind["MACHINE"] = "machine";
+    /**
+     * The application acting on its own behalf by design — a batch, a cron job, an internal workflow, a
+     * system-door read or write, or application code handling a signature-verified inbound message or
+     * webhook (the sender holds a shared secret, not a credential this application issued).
+     */
+    AuditActorKind["SYSTEM"] = "system";
+    /**
+     * Nobody was authenticated, and none was expected: a sign-in or recovery attempt before any factor
+     * succeeded, a public operation, an anonymous visitor session. Routine traffic — kept apart from
+     * `UNATTRIBUTED` so that a failed login is not reported as the anomaly reviewers alert on.
+     */
+    AuditActorKind["UNAUTHENTICATED"] = "unauthenticated";
+    /** A principal was expected and could not be resolved. The anomaly a reviewer should alert on. */
+    AuditActorKind["UNATTRIBUTED"] = "unattributed";
+})(AuditActorKind || (AuditActorKind = {}));
+/**
+ * Which AI agent performed an audited action, and in which execution — present on an audit row ONLY
+ * when an agent acted. Its presence is how the trail says "an agent did this"; `actorKind` still names
+ * the principal whose authority the agent used.
+ *
+ * Evidence only: nothing in the framework authorizes on it. It carries identifiers, never the
+ * conversation's text, the tool's argument values, or digests of them — a digest of a short argument
+ * can be reversed by enumeration, and the audit ledger cannot be scrubbed.
+ *
+ * Filled by the framework: every write an agent's tool makes — through a resource tool, a hand-written
+ * tool, or a system write inside a tool — carries it automatically.
+ */
+export const AuditAgentActorSchema = z.object({
+    /** The agent's declared `ref` (a configuration identifier, not personal data). */
+    agentRef: z.string().min(1).describe('The declared reference of the AI agent that performed the action.'),
+    /**
+     * The conversational execution the action belongs to — a pseudonymous key into a transcript the
+     * user owns. Absent when an agent was invoked outside any conversational execution: the framework
+     * records the agent it knows rather than invent an execution id.
+     */
+    agentExecutionId: z
+        .string()
+        .min(1)
+        .optional()
+        .describe('The conversation run the action belongs to. Absent when the agent acted outside a conversation.'),
+    /** The actors system the execution runs in, when known. */
+    systemRef: z.string().min(1).optional().describe('The actor system the conversation runs in, when known.'),
+    /** The tool the agent called: the `functionRef` of a function tool, or the model-facing name of an MCP tool. */
+    toolName: z.string().min(1).optional().describe('The tool the agent called to perform the action: a function tool’s reference, or an MCP tool’s name.'),
+    /** The human decision that authorised the call, for an approval-gated tool. */
+    decisionRef: z
+        .string()
+        .min(1)
+        .optional()
+        .describe('For a tool that requires approval, the id of the human decision that approved this call.'),
+});
+/** @wildo_source:part:end saas.models.audit-trails.actor-attribution */
 //# sourceMappingURL=audit-actor.shared.schemas.js.map

package/dist/esm/compliance/audit-trails/audit-actor.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"audit-actor.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/compliance/audit-trails/audit-actor.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH;;;;GAIG;AACH,MAAM,CAAN,IAAY,kBAoBX;AApBD,WAAY,kBAAkB;IAC5B;;;;OAIG;IACH,uCAAiB,CAAA;IACjB;;;;;OAKG;IACH,yCAAmB,CAAA;IACnB;;;;OAIG;IACH,mDAA6B,CAAA;AAC/B,CAAC,EApBW,kBAAkB,KAAlB,kBAAkB,QAoB7B;AAED,4FAA4F;AAC5F,MAAM,CAAC,MAAM,qBAAqB,GAAsB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC;AAEzG;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,OAAO,qBAAqB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AACjD,CAAC","sourcesContent":["/**\n * Audit ACTOR vocabulary — what goes in an audit event's `*By` field when there is no acting user.\n *\n * Every auditable-event payload carries an actor field (`deletedBy`, `changedBy`, `removedBy`,\n * `requestedBy`, …) typed as a plain string, whose contract is: **the acting user's id, or a\n * sentinel from this enum saying why there is no user.** A reader can always tell the two apart —\n * these values are not id-shaped.\n *\n * ## Why this exists\n *\n * Every emitter used to fall back to the bare literal `'unknown'`, which merged three genuinely\n * different facts into one token:\n *\n * - the scheduled `organization-purge` batch destroying a tenant — the actor is precisely known, it\n *   is the system;\n * - a machine principal acting on an API key or OAuth client — non-human, but attributable;\n * - a request that should have carried a principal and did not — a real anomaly.\n *\n * An auditor reading `'unknown'` cannot distinguish \"routine automation\" from \"we failed to\n * attribute a privileged action\", so the one case worth investigating was hidden inside the two that\n * are not. Merging semantically distinct concepts because they share a wire value is exactly what\n * the framework forbids; naming them separately restores the distinction.\n *\n * Discovered 2026-08-04 by the `organization-purge-batch-audit` e2e lane, which observed a\n * batch-purged tenant recorded as deleted by `'unknown'`.\n *\n * assurance-control: WILDO.AUDIT.ATTRIBUTION — a security-relevant action must record who performed\n * it, and must not disguise an unattributable action as an ordinary automated one.\n */\n\n/**\n * Sentinel actors for audit `*By` fields. Resolve one with\n * `resolveAuditActorId(executionContext)` from `@wildo-ai/saas-backend-lib` rather than choosing by\n * hand — the mapping from execution type to sentinel belongs in one place.\n */\nexport enum AuditActorSentinel {\n  /**\n   * The system acted with no human principal BY DESIGN — a scheduled batch, a cron job, or an\n   * internally initiated workflow. This is an ATTRIBUTED outcome: the actor is the application\n   * itself, and a reviewer should read it as routine automation.\n   */\n  SYSTEM = 'system',\n  /**\n   * A machine principal acted: an organization or application API key, or an OAuth client. Non-human\n   * but legitimate and traceable — the specific credential is recorded on the execution context\n   * (`initiatorIds.machineCredential`) and on the machine-authentication event trail, so this field\n   * records the KIND of actor rather than duplicating a second id shape into a user-id slot.\n   */\n  MACHINE = 'machine',\n  /**\n   * A principal was expected and could not be resolved. Unlike the two above this is an ANOMALY, and\n   * it is the value a reviewer should alert on: a privileged action happened and the trail cannot\n   * say who performed it.\n   */\n  UNATTRIBUTED = 'unattributed',\n}\n\n/** Every sentinel value, for consumers that need to tell a sentinel from a real user id. */\nexport const AUDIT_ACTOR_SENTINELS: readonly string[] = Object.freeze(Object.values(AuditActorSentinel));\n\n/**\n * Whether an audit `*By` value is a sentinel rather than a user id.\n *\n * Use this instead of comparing against literals at a call site — a consumer that hard-codes\n * `=== 'system'` silently stops matching if the vocabulary grows.\n */\nexport function isAuditActorSentinel(actorId: string): boolean {\n  return AUDIT_ACTOR_SENTINELS.includes(actorId);\n}\n"]}
+{"version":3,"file":"audit-actor.shared.schemas.js","sourceRoot":"","sources":["../../../../src/compliance/audit-trails/audit-actor.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;GAIG;AACH,MAAM,CAAN,IAAY,kBAoBX;AApBD,WAAY,kBAAkB;IAC5B;;;;OAIG;IACH,uCAAiB,CAAA;IACjB;;;;;OAKG;IACH,yCAAmB,CAAA;IACnB;;;;OAIG;IACH,mDAA6B,CAAA;AAC/B,CAAC,EApBW,kBAAkB,KAAlB,kBAAkB,QAoB7B;AAED,4FAA4F;AAC5F,MAAM,CAAC,MAAM,qBAAqB,GAAsB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC;AAEzG;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,OAAO,qBAAqB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AACjD,CAAC;AAED,oJAAoJ;AACpJ;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAN,IAAY,cAyBX;AAzBD,WAAY,cAAc;IACxB,wFAAwF;IACxF,+BAAa,CAAA;IACb;;;;OAIG;IACH,uDAAqC,CAAA;IACrC,iIAAiI;IACjI,qCAAmB,CAAA;IACnB;;;;OAIG;IACH,mCAAiB,CAAA;IACjB;;;;OAIG;IACH,qDAAmC,CAAA;IACnC,kGAAkG;IAClG,+CAA6B,CAAA;AAC/B,CAAC,EAzBW,cAAc,KAAd,cAAc,QAyBzB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,kFAAkF;IAClF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,mEAAmE,CAAC;IACzG;;;;OAIG;IACH,gBAAgB,EAAE,CAAC;SAChB,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,EAAE;SACV,QAAQ,CAAC,iGAAiG,CAAC;IAC9G,2DAA2D;IAC3D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,wDAAwD,CAAC;IAC1G,gHAAgH;IAChH,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sGAAsG,CAAC;IACvJ,+EAA+E;IAC/E,WAAW,EAAE,CAAC;SACX,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,EAAE;SACV,QAAQ,CAAC,0FAA0F,CAAC;CACxG,CAAC,CAAC;AAEH,wEAAwE","sourcesContent":["/**\n * Audit ACTOR vocabulary — what goes in an audit event's `*By` field when there is no acting user.\n *\n * Every auditable-event payload carries an actor field (`deletedBy`, `changedBy`, `removedBy`,\n * `requestedBy`, …) typed as a plain string, whose contract is: **the acting user's id, or a\n * sentinel from this enum saying why there is no user.** A reader can always tell the two apart —\n * these values are not id-shaped.\n *\n * ## Why this exists\n *\n * Every emitter used to fall back to the bare literal `'unknown'`, which merged three genuinely\n * different facts into one token:\n *\n * - the scheduled `organization-purge` batch destroying a tenant — the actor is precisely known, it\n *   is the system;\n * - a machine principal acting on an API key or OAuth client — non-human, but attributable;\n * - a request that should have carried a principal and did not — a real anomaly.\n *\n * An auditor reading `'unknown'` cannot distinguish \"routine automation\" from \"we failed to\n * attribute a privileged action\", so the one case worth investigating was hidden inside the two that\n * are not. Merging semantically distinct concepts because they share a wire value is exactly what\n * the framework forbids; naming them separately restores the distinction.\n *\n * Discovered 2026-08-04 by the `organization-purge-batch-audit` e2e lane, which observed a\n * batch-purged tenant recorded as deleted by `'unknown'`.\n *\n * assurance-control: WILDO.AUDIT.ATTRIBUTION — a security-relevant action must record who performed\n * it, and must not disguise an unattributable action as an ordinary automated one.\n */\n\nimport { z } from 'zod';\n\n/**\n * Sentinel actors for audit `*By` fields. Resolve one with\n * `resolveAuditActorId(executionContext)` from `@wildo-ai/saas-backend-lib` rather than choosing by\n * hand — the mapping from execution type to sentinel belongs in one place.\n */\nexport enum AuditActorSentinel {\n  /**\n   * The system acted with no human principal BY DESIGN — a scheduled batch, a cron job, or an\n   * internally initiated workflow. This is an ATTRIBUTED outcome: the actor is the application\n   * itself, and a reviewer should read it as routine automation.\n   */\n  SYSTEM = 'system',\n  /**\n   * A machine principal acted: an organization or application API key, or an OAuth client. Non-human\n   * but legitimate and traceable — the specific credential is recorded on the execution context\n   * (`initiatorIds.machineCredential`) and on the machine-authentication event trail, so this field\n   * records the KIND of actor rather than duplicating a second id shape into a user-id slot.\n   */\n  MACHINE = 'machine',\n  /**\n   * A principal was expected and could not be resolved. Unlike the two above this is an ANOMALY, and\n   * it is the value a reviewer should alert on: a privileged action happened and the trail cannot\n   * say who performed it.\n   */\n  UNATTRIBUTED = 'unattributed',\n}\n\n/** Every sentinel value, for consumers that need to tell a sentinel from a real user id. */\nexport const AUDIT_ACTOR_SENTINELS: readonly string[] = Object.freeze(Object.values(AuditActorSentinel));\n\n/**\n * Whether an audit `*By` value is a sentinel rather than a user id.\n *\n * Use this instead of comparing against literals at a call site — a consumer that hard-codes\n * `=== 'system'` silently stops matching if the vocabulary grows.\n */\nexport function isAuditActorSentinel(actorId: string): boolean {\n  return AUDIT_ACTOR_SENTINELS.includes(actorId);\n}\n\n/** @wildo_source:part:start saas.models.audit-trails.actor-attribution facet:layer:shared facet:family:audit-trails facet:audience:app-developer */\n/**\n * The KIND of principal whose authority an audited action used — recorded on every audit row as\n * `actorKind`, beside `userId`.\n *\n * It answers ONE question and nothing else: *under whose authority did this happen?* Whether an AI\n * agent performed the action is a different question, answered by the presence of the row's\n * `agentActor` ({@link AuditAgentActorSchema}). An agent is never a principal: it always acts under a\n * user's, a machine's, or the application's own authority, so there is deliberately no `AGENT` member.\n * Folding the two into one field would make it answer two questions and a reader could no longer tell\n * \"the user did it\" from \"an agent did it with the user's authority\".\n *\n * The framework fills it on every row, so an application never writes it. An application emitting its\n * own event through `AuditLogsBackendService.logEvent` passes its request context, and with none names\n * the principal instead: `userAuditPrincipal(userId)`, `SYSTEM_AUDIT_PRINCIPAL`,\n * `UNAUTHENTICATED_AUDIT_PRINCIPAL` or `machineCredentialAuditPrincipal(...)`, all exported by\n * `@wildo-ai/saas-backend-lib`. With neither, the kind is read off the `userId` the event carries — right\n * only when that id is the actor, not the subject.\n *\n * assurance-control: WILDO.AUDIT.ATTRIBUTION — every audit row names the kind of principal whose\n * authority was used, so an unattributed action stays distinguishable from routine automation.\n */\nexport enum AuditActorKind {\n  /** A signed-in person acting through a first-party session. `userId` is that person. */\n  USER = 'user',\n  /**\n   * A person's authority, exercised by an EXTERNAL OAuth client they delegated to (an A2A or MCP\n   * client). `userId` is the delegating person and `delegatingClientId` names the client, taken from\n   * the verified token's `azp`.\n   */\n  DELEGATED_CLIENT = 'delegated_client',\n  /** An organization or application machine credential (API key or OAuth client credentials). `principalCredentialId` names it. */\n  MACHINE = 'machine',\n  /**\n   * The application acting on its own behalf by design — a batch, a cron job, an internal workflow, a\n   * system-door read or write, or application code handling a signature-verified inbound message or\n   * webhook (the sender holds a shared secret, not a credential this application issued).\n   */\n  SYSTEM = 'system',\n  /**\n   * Nobody was authenticated, and none was expected: a sign-in or recovery attempt before any factor\n   * succeeded, a public operation, an anonymous visitor session. Routine traffic — kept apart from\n   * `UNATTRIBUTED` so that a failed login is not reported as the anomaly reviewers alert on.\n   */\n  UNAUTHENTICATED = 'unauthenticated',\n  /** A principal was expected and could not be resolved. The anomaly a reviewer should alert on. */\n  UNATTRIBUTED = 'unattributed',\n}\n\n/**\n * Which AI agent performed an audited action, and in which execution — present on an audit row ONLY\n * when an agent acted. Its presence is how the trail says \"an agent did this\"; `actorKind` still names\n * the principal whose authority the agent used.\n *\n * Evidence only: nothing in the framework authorizes on it. It carries identifiers, never the\n * conversation's text, the tool's argument values, or digests of them — a digest of a short argument\n * can be reversed by enumeration, and the audit ledger cannot be scrubbed.\n *\n * Filled by the framework: every write an agent's tool makes — through a resource tool, a hand-written\n * tool, or a system write inside a tool — carries it automatically.\n */\nexport const AuditAgentActorSchema = z.object({\n  /** The agent's declared `ref` (a configuration identifier, not personal data). */\n  agentRef: z.string().min(1).describe('The declared reference of the AI agent that performed the action.'),\n  /**\n   * The conversational execution the action belongs to — a pseudonymous key into a transcript the\n   * user owns. Absent when an agent was invoked outside any conversational execution: the framework\n   * records the agent it knows rather than invent an execution id.\n   */\n  agentExecutionId: z\n    .string()\n    .min(1)\n    .optional()\n    .describe('The conversation run the action belongs to. Absent when the agent acted outside a conversation.'),\n  /** The actors system the execution runs in, when known. */\n  systemRef: z.string().min(1).optional().describe('The actor system the conversation runs in, when known.'),\n  /** The tool the agent called: the `functionRef` of a function tool, or the model-facing name of an MCP tool. */\n  toolName: z.string().min(1).optional().describe('The tool the agent called to perform the action: a function tool’s reference, or an MCP tool’s name.'),\n  /** The human decision that authorised the call, for an approval-gated tool. */\n  decisionRef: z\n    .string()\n    .min(1)\n    .optional()\n    .describe('For a tool that requires approval, the id of the human decision that approved this call.'),\n});\nexport type AuditAgentActor = z.infer<typeof AuditAgentActorSchema>;\n/** @wildo_source:part:end saas.models.audit-trails.actor-attribution */\n"]}

package/dist/esm/compliance/audit-trails/audit-export-projection.shared.schemas.d.ts

@@ -243,6 +243,12 @@ export declare const AUDIT_EXPORT_FIELD_DISCLOSURE: {
     readonly sourceEnvironment: AuditExportDisclosureTier.FLOOR;
     /** Success or failure. Half of what an audit record is for. */
     readonly outcome: AuditExportDisclosureTier.FLOOR;
+    /**
+     * The KIND of principal whose authority was used — a vocabulary value, never an identity. FLOOR
+     * beside `userId` because without it a minimised feed cannot tell a person from a delegated client,
+     * a machine or the application itself, which is the first question asked of any privileged action.
+     */
+    readonly actorKind: AuditExportDisclosureTier.FLOOR;
     /** A person's address. The single field most DPAs name first. */
     readonly userEmail: AuditExportDisclosureTier.ATTRIBUTION;
     /** Personal data in its own right, and the field that places a person geographically. */
@@ -270,7 +276,35 @@ export declare const AUDIT_EXPORT_FIELD_DISCLOSURE: {
     /** Which identity source. A configuration reference. */
     readonly authSource: AuditExportDisclosureTier.CONTEXT;
     readonly providerRef: AuditExportDisclosureTier.CONTEXT;
+    /** The connection a stored provider credential belongs to (#1670). A configuration reference, like the ref. */
+    readonly connectionRef: AuditExportDisclosureTier.CONTEXT;
     readonly connectionType: AuditExportDisclosureTier.CONTEXT;
+    /**
+     * The AI agent that acted — a configuration identifier, beside `authSource` rather than beside the
+     * personal-data fields. A tenant minimising for personal data must still be able to say which agent
+     * did what, so this is deliberately NOT ATTRIBUTION.
+     */
+    readonly agentRef: AuditExportDisclosureTier.CONTEXT;
+    /**
+     * The agent's execution — a pseudonymous key into a transcript the user owns, which resolves to
+     * nothing once that transcript is erased. It names a run, not a person, so it travels with the
+     * agent's identity rather than with the personal-data tier.
+     */
+    readonly agentExecutionId: AuditExportDisclosureTier.CONTEXT;
+    /** The external OAuth client a person delegated to. A software client's id, not a person's. */
+    readonly delegatingClientId: AuditExportDisclosureTier.CONTEXT;
+    /**
+     * #1597 — the relationship a firm's principal acted through, and the firm. Organization and relationship
+     * identifiers, not a person's: CONTEXT, beside the other "under what arrangement did this act?" fields.
+     */
+    readonly actingViaServiceProviderRelationshipId: AuditExportDisclosureTier.CONTEXT;
+    readonly providerOrganizationId: AuditExportDisclosureTier.CONTEXT;
+    /**
+     * #1633 — where the factor that satisfied the client's authentication policy came from. An enum naming a SOURCE
+     * (this application, or the firm's trusted identity provider), never a person or a proof: CONTEXT beside the
+     * relationship it qualifies.
+     */
+    readonly serviceProviderFactorSource: AuditExportDisclosureTier.CONTEXT;
     /** The open per-event bag. Gated a second time by the event type's own disclosure class. */
     readonly eventData: AuditExportDisclosureTier.DETAIL;
     /**

package/dist/esm/compliance/audit-trails/audit-export-projection.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit-export-projection.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/audit-trails/audit-export-projection.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoGG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,0BAA0B,CAAC;AAElC,OAAO,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAC1E,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,+CAA+C,CAAC;AAEhG;;;;;;;;;GASG;AACH,oBAAY,yBAAyB;IACnC;;;;OAIG;IACH,KAAK,UAAU;IACf;;;OAGG;IACH,WAAW,gBAAgB;IAC3B;;;;;;OAMG;IACH,OAAO,YAAY;IACnB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;IACH,MAAM,WAAW;CAClB;AAED;;;;;;;;;;GAUG;AACH,oBAAY,8BAA8B;IACxC;;;;;;;;OAQG;IACH,cAAc,mBAAmB;IACjC;;;;;;;OAOG;IACH,cAAc,mBAAmB;CAClC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,kCAAkC,GAAG;IAC/C,QAAQ,EAAE,CAAC,IAAI,MAAM,QAAQ,CAAC,0BAA0B,CAAC,CAAC,CAAC,GAAG,yBAAyB;CACxF,CAAC;AAEF,eAAO,MAAM,6BAA6B;IAExC,gGAAgG;;IAEhG,iGAAiG;;IAEjG,kFAAkF;;IAElF,6EAA6E;;IAE7E,wEAAwE;;IAExE,gGAAgG;;IAEhG;;;;;OAKG;;IAEH,kFAAkF;;IAElF,yFAAyF;;IAEzF,6FAA6F;;IAE7F,+DAA+D;;IAI/D,iEAAiE;;IAEjE,yFAAyF;;IAEzF,4DAA4D;;IAE5D,0BAA0B;;IAE1B;;;;OAIG;;IAIH,uFAAuF;;IAEvF,qDAAqD;;IAErD,sGAAsG;;;;IAItG,qEAAqE;;IAErE,wDAAwD;;;;IAMxD,4FAA4F;;IAE5F;;;;;;;;;;;;;;;;;;;;;OAqBG;;CAEkD,CAAC;AAExD,oEAAoE;AACpE,MAAM,MAAM,wBAAwB,GAAG,MAAM,OAAO,6BAA6B,CAAC;AAElF,mEAAmE;AACnE,KAAK,sBAAsB,GAAG;KAC3B,CAAC,IAAI,wBAAwB,GAAG,CAAC,OAAO,6BAA6B,CAAC,CAAC,CAAC,CAAC,SAAS,yBAAyB,CAAC,KAAK,GAC9G,KAAK,GACL,CAAC;CACN,CAAC,wBAAwB,CAAC,CAAC;AAE5B;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,KAAK,sBAAsB,GAAG;KAC3B,CAAC,IAAI,MAAM,0BAA0B,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,IAAI,CAAC,0BAA0B,EAAE,CAAC,CAAC,GACvG,CAAC,GACD,KAAK;CACV,CAAC,MAAM,0BAA0B,CAAC,CAAC;AAEpC,iFAAiF;AACjF,KAAK,qBAAqB,GAAG,OAAO,CAAC,MAAM,0BAA0B,EAAE,sBAAsB,CAAC,CAAC;AAE/F;;;;;GAKG;AACH,KAAK,iCAAiC,GAAG,OAAO,CAAC,OAAO,CAAC,sBAAsB,EAAE,qBAAqB,CAAC,EAAE,WAAW,CAAC,CAAC;AAEtH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,2CAA2C,EAAE,CAAC,iCAAiC,CAAC,SAAS,CAAC,KAAK,CAAC,GACzG,IAAI,GACJ,iCAAwC,CAAC;AAE7C;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,kCAAkC,EAAE,MAAM,CAAC,sBAAsB,EAAE,8BAA8B,CAgQ7G,CAAC;AAEF;;;;;;;;GAQG;AAWH,eAAO,MAAM,qCAAqC;;;;;;;iBAuChD,CAAC;AAEH,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC;AAErG;;;;;;;;GAQG;AACH,eAAO,MAAM,4BAA4B,EAAE,gCAU1C,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,MAAM,GAAG,8BAA8B,CAK5F;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,8BAA8B,CAC5C,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,gCAAgC,GAC5C,WAAW,CAAC,wBAAwB,CAAC,CAsBvC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,0BAA0B,EACpC,WAAW,EAAE,gCAAgC,GAC5C,0BAA0B,CAe5B"}
+{"version":3,"file":"audit-export-projection.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/compliance/audit-trails/audit-export-projection.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoGG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,0BAA0B,CAAC;AAElC,OAAO,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAC1E,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,+CAA+C,CAAC;AAEhG;;;;;;;;;GASG;AACH,oBAAY,yBAAyB;IACnC;;;;OAIG;IACH,KAAK,UAAU;IACf;;;OAGG;IACH,WAAW,gBAAgB;IAC3B;;;;;;OAMG;IACH,OAAO,YAAY;IACnB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;IACH,MAAM,WAAW;CAClB;AAED;;;;;;;;;;GAUG;AACH,oBAAY,8BAA8B;IACxC;;;;;;;;OAQG;IACH,cAAc,mBAAmB;IACjC;;;;;;;OAOG;IACH,cAAc,mBAAmB;CAClC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,kCAAkC,GAAG;IAC/C,QAAQ,EAAE,CAAC,IAAI,MAAM,QAAQ,CAAC,0BAA0B,CAAC,CAAC,CAAC,GAAG,yBAAyB;CACxF,CAAC;AAEF,eAAO,MAAM,6BAA6B;IAExC,gGAAgG;;IAEhG,iGAAiG;;IAEjG,kFAAkF;;IAElF,6EAA6E;;IAE7E,wEAAwE;;IAExE,gGAAgG;;IAEhG;;;;;OAKG;;IAEH,kFAAkF;;IAElF,yFAAyF;;IAEzF,6FAA6F;;IAE7F,+DAA+D;;IAE/D;;;;OAIG;;IAIH,iEAAiE;;IAEjE,yFAAyF;;IAEzF,4DAA4D;;IAE5D,0BAA0B;;IAE1B;;;;OAIG;;IAIH,uFAAuF;;IAEvF,qDAAqD;;IAErD,sGAAsG;;;;IAItG,qEAAqE;;IAErE,wDAAwD;;;IAGxD,+GAA+G;;;IAG/G;;;;OAIG;;IAEH;;;;OAIG;;IAEH,+FAA+F;;IAE/F;;;OAGG;;;IAGH;;;;OAIG;;IAIH,4FAA4F;;IAE5F;;;;;;;;;;;;;;;;;;;;;OAqBG;;CAEkD,CAAC;AAExD,oEAAoE;AACpE,MAAM,MAAM,wBAAwB,GAAG,MAAM,OAAO,6BAA6B,CAAC;AAElF,mEAAmE;AACnE,KAAK,sBAAsB,GAAG;KAC3B,CAAC,IAAI,wBAAwB,GAAG,CAAC,OAAO,6BAA6B,CAAC,CAAC,CAAC,CAAC,SAAS,yBAAyB,CAAC,KAAK,GAC9G,KAAK,GACL,CAAC;CACN,CAAC,wBAAwB,CAAC,CAAC;AAE5B;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,KAAK,sBAAsB,GAAG;KAC3B,CAAC,IAAI,MAAM,0BAA0B,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,IAAI,CAAC,0BAA0B,EAAE,CAAC,CAAC,GACvG,CAAC,GACD,KAAK;CACV,CAAC,MAAM,0BAA0B,CAAC,CAAC;AAEpC,iFAAiF;AACjF,KAAK,qBAAqB,GAAG,OAAO,CAAC,MAAM,0BAA0B,EAAE,sBAAsB,CAAC,CAAC;AAE/F;;;;;GAKG;AACH,KAAK,iCAAiC,GAAG,OAAO,CAAC,OAAO,CAAC,sBAAsB,EAAE,qBAAqB,CAAC,EAAE,WAAW,CAAC,CAAC;AAEtH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,2CAA2C,EAAE,CAAC,iCAAiC,CAAC,SAAS,CAAC,KAAK,CAAC,GACzG,IAAI,GACJ,iCAAwC,CAAC;AAE7C;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,kCAAkC,EAAE,MAAM,CAAC,sBAAsB,EAAE,8BAA8B,CAoW7G,CAAC;AAEF;;;;;;;;GAQG;AAWH,eAAO,MAAM,qCAAqC;;;;;;;iBAuChD,CAAC;AAEH,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC;AAErG;;;;;;;;GAQG;AACH,eAAO,MAAM,4BAA4B,EAAE,gCAU1C,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,MAAM,GAAG,8BAA8B,CAK5F;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,8BAA8B,CAC5C,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,gCAAgC,GAC5C,WAAW,CAAC,wBAAwB,CAAC,CAsBvC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,0BAA0B,EACpC,WAAW,EAAE,gCAAgC,GAC5C,0BAA0B,CAe5B"}

package/dist/esm/compliance/audit-trails/audit-export-projection.shared.schemas.js

@@ -233,6 +233,12 @@ export const AUDIT_EXPORT_FIELD_DISCLOSURE = {
     sourceEnvironment: AuditExportDisclosureTier.FLOOR,
     /** Success or failure. Half of what an audit record is for. */
     outcome: AuditExportDisclosureTier.FLOOR,
+    /**
+     * The KIND of principal whose authority was used — a vocabulary value, never an identity. FLOOR
+     * beside `userId` because without it a minimised feed cannot tell a person from a delegated client,
+     * a machine or the application itself, which is the first question asked of any privileged action.
+     */
+    actorKind: AuditExportDisclosureTier.FLOOR,
     // ── ATTRIBUTION ──────────────────────────────────────────────────────────────────────────────
     /** A person's address. The single field most DPAs name first. */
     userEmail: AuditExportDisclosureTier.ATTRIBUTION,
@@ -262,7 +268,35 @@ export const AUDIT_EXPORT_FIELD_DISCLOSURE = {
     /** Which identity source. A configuration reference. */
     authSource: AuditExportDisclosureTier.CONTEXT,
     providerRef: AuditExportDisclosureTier.CONTEXT,
+    /** The connection a stored provider credential belongs to (#1670). A configuration reference, like the ref. */
+    connectionRef: AuditExportDisclosureTier.CONTEXT,
     connectionType: AuditExportDisclosureTier.CONTEXT,
+    /**
+     * The AI agent that acted — a configuration identifier, beside `authSource` rather than beside the
+     * personal-data fields. A tenant minimising for personal data must still be able to say which agent
+     * did what, so this is deliberately NOT ATTRIBUTION.
+     */
+    agentRef: AuditExportDisclosureTier.CONTEXT,
+    /**
+     * The agent's execution — a pseudonymous key into a transcript the user owns, which resolves to
+     * nothing once that transcript is erased. It names a run, not a person, so it travels with the
+     * agent's identity rather than with the personal-data tier.
+     */
+    agentExecutionId: AuditExportDisclosureTier.CONTEXT,
+    /** The external OAuth client a person delegated to. A software client's id, not a person's. */
+    delegatingClientId: AuditExportDisclosureTier.CONTEXT,
+    /**
+     * #1597 — the relationship a firm's principal acted through, and the firm. Organization and relationship
+     * identifiers, not a person's: CONTEXT, beside the other "under what arrangement did this act?" fields.
+     */
+    actingViaServiceProviderRelationshipId: AuditExportDisclosureTier.CONTEXT,
+    providerOrganizationId: AuditExportDisclosureTier.CONTEXT,
+    /**
+     * #1633 — where the factor that satisfied the client's authentication policy came from. An enum naming a SOURCE
+     * (this application, or the firm's trusted identity provider), never a person or a proof: CONTEXT beside the
+     * relationship it qualifies.
+     */
+    serviceProviderFactorSource: AuditExportDisclosureTier.CONTEXT,
     // ── DETAIL ───────────────────────────────────────────────────────────────────────────────────
     /** The open per-event bag. Gated a second time by the event type's own disclosure class. */
     eventData: AuditExportDisclosureTier.DETAIL,
@@ -441,12 +475,42 @@ export const AUDIT_EXPORT_EVENT_DATA_DISCLOSURE = {
      * blocks. Authored configuration with no human actor at all — the event is emitted at boot.
      */
     [CoreAuditableEventType.APPLICATION_AUTH_POLICY_CHANGED]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    // Read: run ref, instants, outcome vocabulary and per-class counts. System state, no person, no free text.
+    [CoreAuditableEventType.RETENTION_ENFORCEMENT_RECORDED]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
     // ── Outbound webhook ─────────────────────────────────────────────────────────────────────────
     /**
      * VERIFIED ADMINISTRATIVE: the dispatching actor reference, the endpoint id, the destination
      * HOST, the outcome and a duration. An operator-supplied URL is configuration, not a person.
      */
     [CoreAuditableEventType.WEBHOOK_ENDPOINT_TEST_DISPATCHED]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    // Inbound deliveries (#1596): schemas read — ids, source keys, handler refs and classified codes, never
+    // the payload, a header value or an error message. REPLAYED carries the operator's free-text
+    // justification, so it keeps the fail-closed tier.
+    [CoreAuditableEventType.INBOUND_DELIVERY_REJECTED]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    [CoreAuditableEventType.INBOUND_DELIVERY_ACCEPTED]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    [CoreAuditableEventType.INBOUND_DELIVERY_UNROUTABLE]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    [CoreAuditableEventType.INBOUND_DELIVERY_PROCESSED]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    [CoreAuditableEventType.INBOUND_DELIVERY_FAILED]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    [CoreAuditableEventType.INBOUND_DELIVERY_DEAD]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    [CoreAuditableEventType.INBOUND_DELIVERY_REPLAYED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    // #1630: ids, channels and named outcomes only — schemas read; no address, subject or free text.
+    [CoreAuditableEventType.INBOUND_DELIVERY_BELOW_ASSURANCE]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    [CoreAuditableEventType.INBOUND_REPLY_SENT]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    [CoreAuditableEventType.INBOUND_REPLY_FAILED]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    [CoreAuditableEventType.INBOUND_REPLY_TOKEN_REVOKED]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    [CoreAuditableEventType.INBOUND_REPLY_TOKEN_DOWNGRADED]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    // #1600: schemas read. A domain and a client mailbox address are an ORGANIZATION's configuration, never a
+    // person's; a received message is named by its row id, a classified reason and counts — no sender, subject
+    // or filename.
+    [CoreAuditableEventType.ORGANIZATION_EMAIL_DOMAIN_CLAIMED]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    [CoreAuditableEventType.ORGANIZATION_EMAIL_DOMAIN_OWNERSHIP_VERIFIED]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    [CoreAuditableEventType.ORGANIZATION_EMAIL_DOMAIN_VERIFIED]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    [CoreAuditableEventType.ORGANIZATION_EMAIL_DOMAIN_SUSPENDED]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    [CoreAuditableEventType.ORGANIZATION_EMAIL_DOMAIN_REMOVED]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    [CoreAuditableEventType.CLIENT_MAILBOX_CREATED]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    [CoreAuditableEventType.CLIENT_MAILBOX_REMOVED]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    [CoreAuditableEventType.INBOUND_EMAIL_ATTACHMENT_WITHHELD]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    [CoreAuditableEventType.INBOUND_EMAIL_REJECTED_LIMIT]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
     // ── SCIM directory provisioning ──────────────────────────────────────────────────────────────
     // Provisioning is ABOUT people by definition; the token events ride the same lane and are not
     // separately verified.
@@ -535,6 +599,40 @@ export const AUDIT_EXPORT_EVENT_DATA_DISCLOSURE = {
     [CoreAuditableEventType.RESOURCE_OPERATION_DENIED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
     [CoreAuditableEventType.CROSS_TENANT_ADMINISTRATIVE_ACCESS]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
     [CoreAuditableEventType.PLATFORM_ACCESS_GRANT_LIFECYCLE]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    // Names the held person (`subjectUserId`) on a data-subject hold (#1634).
+    [CoreAuditableEventType.LEGAL_HOLD_PLACED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.LEGAL_HOLD_RELEASED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    // Read with the schema in front of it (#1598): an aggregate id, the tenant, a month, a currency code and an
+    // invoice-ref id — configuration of a billing record, no person, no free text, no amount.
+    [CoreAuditableEventType.MODEL_COST_AGGREGATE_INVOICE_LINKED]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    [CoreAuditableEventType.CORRECTION_CAPTURE_SETTING_CHANGED]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    [CoreAuditableEventType.EVALUATION_EXPORT_AUTHORIZATION_CHANGED]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    [CoreAuditableEventType.EVALUATION_DATASET_EXPORTED]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    [CoreAuditableEventType.EVALUATION_DATASET_EXPORT_REFUSED]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    // The lifecycle carries `purpose` and `decisionReason` (free text people typed); the assignment events
+    // name the expert, who is the SUBJECT rather than the actor. Both fail closed (#1597).
+    [CoreAuditableEventType.SERVICE_PROVIDER_RELATIONSHIP_LIFECYCLE]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.SERVICE_PROVIDER_EXPERT_ASSIGNED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.SERVICE_PROVIDER_EXPERT_UNASSIGNED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    // The per-expert approval events (#1612) name the expert — the SUBJECT, not the actor — like the assignment events.
+    [CoreAuditableEventType.SERVICE_PROVIDER_EXPERT_APPROVAL_REQUESTED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.SERVICE_PROVIDER_EXPERT_APPROVAL_GRANTED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.SERVICE_PROVIDER_EXPERT_APPROVAL_DENIED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.SERVICE_PROVIDER_EXPERT_APPROVAL_LAPSED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    // Read before marking (#1631): organization ids, a relationship and grant id, a capability, a date and the acting
+    // client user — resource and actor references the envelope already implies; no contact data, no free text.
+    [CoreAuditableEventType.SERVICE_PROVIDER_CAPABILITY_GRANTED]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    [CoreAuditableEventType.SERVICE_PROVIDER_CAPABILITY_REVOKED]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    // Read before marking: organization ids, a relationship id, an OAuth client id and the acting user —
+    // resource and actor references the envelope already implies; no contact data, no free text.
+    [CoreAuditableEventType.SERVICE_PROVIDER_MACHINE_CLIENT_ADMISSION_CHANGED]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    // Read before marking (#1633, #1632): organization ids, a relationship id, enum values, a boolean and the acting user —
+    // no contact data and no free text. The satisfied-factor row names the expert as the subject of the proof, so it
+    // fails closed like the assignment events.
+    [CoreAuditableEventType.SERVICE_PROVIDER_MFA_TRUST_CHANGED]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    [CoreAuditableEventType.SERVICE_PROVIDER_CLIENT_AUTHENTICATION_SATISFIED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.SERVICE_PROVIDER_ACTIVITY_FEED_DECIDED]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    [CoreAuditableEventType.SERVICE_PROVIDER_ACTIVITY_FEED_DISCLOSURE_CHANGED]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
     [CoreAuditableEventType.PLATFORM_DIRECTORY_ACCESS]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
     [CoreAuditableEventType.SYSTEM_CONTEXT_READ]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
     [CoreAuditableEventType.SYSTEM_CONTEXT_WRITE]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
@@ -545,12 +643,48 @@ export const AUDIT_EXPORT_EVENT_DATA_DISCLOSURE = {
     [CoreAuditableEventType.COLLECTION_DATA_EXPORT]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
     // ── External integration ─────────────────────────────────────────────────────────────────────
     [CoreAuditableEventType.HTTP_API_READ_THROUGH_ACCESS]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.HTTP_API_WRITE_THROUGH]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    // Both name the initiating user and the organization; the executed row names a remote record key (#1678).
+    [CoreAuditableEventType.SYSTEM_OF_RECORD_ACTION_EXECUTED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.SYSTEM_OF_RECORD_ACTION_REFUSED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    // #1734 — `reason` and `statedOperator` are an operator's free text, which may name anyone.
+    [CoreAuditableEventType.EXTERNAL_DATA_PIPELINE_RESET]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    // #2039 — `reason` and `statedOperator` are an operator's free text, as on the reset.
+    [CoreAuditableEventType.EXTERNAL_DATA_OUTBOUND_UNKNOWN_RESOLVED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    // #1723 — a remote record's key and the row it links to identify a record that may be a person's.
+    [CoreAuditableEventType.EXTERNAL_DATA_CONFLICT_RESOLVED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
     [CoreAuditableEventType.HTTP_API_EXTERNAL_ERASURE]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
     [CoreAuditableEventType.HTTP_API_NON_ERASURE_ACKNOWLEDGED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    // Names the erased subject's ids beside the recipient: the same exposure as the acknowledged-hole row above.
+    [CoreAuditableEventType.SUBJECT_ERASURE_RECIPIENT_OUTCOME]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
     [CoreAuditableEventType.PROVIDER_OPERATION_CALL]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
     [CoreAuditableEventType.PROVIDER_OPERATION_DENIED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
     [CoreAuditableEventType.MCP_TOOL_CALL]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
-    [CoreAuditableEventType.AGENT_TOOL_APPROVAL_MODIFIED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    // SUBJECT_DETAIL like its two siblings, for their reason: `connectionOwnerId` names whose account the call spent, and
+    // for a file read through a person's Drive that is the LINKER — a person the envelope does not imply when someone
+    // else read the file (#1712 review). It names no recipient, number, file, customer or payload (#412), but ADMINISTRATIVE
+    // admits only ids the envelope already implies, and a wrong ADMINISTRATIVE mark is the harmful direction.
+    [CoreAuditableEventType.PROVIDER_CAPABILITY_CALL]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    // #1594: decision rows name the requester, the decider and the people a decision moved between, so
+    // they are subject detail. They carry no argument values, which is what keeps them exportable at all.
+    [CoreAuditableEventType.HUMAN_DECISION_REQUESTED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.HUMAN_DECISION_RESOLVED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.HUMAN_DECISION_REASSIGNED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.HUMAN_DECISION_ESCALATED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.HUMAN_DECISION_CLAIMED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.HUMAN_DECISION_ANSWER_REFUSED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    // #1628 — ids, stages, counts and a pause-state identifier, the same weight as the rest of the family.
+    [CoreAuditableEventType.HUMAN_DECISION_DEADLINE_MISSED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.HUMAN_DECISION_ESCALATION_FIRED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.HUMAN_DECISION_CLOCK_PAUSED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    [CoreAuditableEventType.HUMAN_DECISION_CLOCK_RESUMED]: AuditExportEventDataDisclosure.SUBJECT_DETAIL,
+    // #1611 — read against the four schemas: agent refs, organization / client / relationship ids, an
+    // occurrence id, a case reference (resource type and id), enum reasons. No contact data, no supplied
+    // values, no free text: the turn's input and the agent's instruction are never in the bag.
+    [CoreAuditableEventType.AUTONOMOUS_AGENT_BOUND]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    [CoreAuditableEventType.AUTONOMOUS_AGENT_UNBOUND]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    [CoreAuditableEventType.AUTONOMOUS_AGENT_TURN_STARTED]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
+    [CoreAuditableEventType.AUTONOMOUS_AGENT_TURN_REFUSED]: AuditExportEventDataDisclosure.ADMINISTRATIVE,
     /*
      * Everything else in this bag IS configuration — the transition, the assignment row, the declared
      * instance, the remote partition key, and the units on either side of the move. On those alone it
@@ -611,7 +745,7 @@ export const SiemExportProjectionDeclarationSchema = z.object({
         AuditExportDisclosureTier.ATTRIBUTION,
         AuditExportDisclosureTier.CONTEXT,
         AuditExportDisclosureTier.DETAIL,
-    ]),
+    ]).describe("The envelope tiers this destination receives beyond the floor. The floor (the record's identity, its outcome and its actor reference) is always sent, so an empty list sends the floor alone. Defaults to every tier."),
     /**
      * Which `eventData` bags this destination may receive, by the EVENT TYPE's declared class. Read
      * only when {@link AuditExportDisclosureTier.DETAIL} is disclosed; an event type outside the core
@@ -620,7 +754,7 @@ export const SiemExportProjectionDeclarationSchema = z.object({
     disclosedEventDataClasses: z.array(z.enum(AuditExportEventDataDisclosure).systemEnum('AuditExportEventDataDisclosure')).default([
         AuditExportEventDataDisclosure.SUBJECT_DETAIL,
         AuditExportEventDataDisclosure.ADMINISTRATIVE,
-    ]),
+    ]).describe("Which classes of event detail this destination receives, judged by each event type's declared class. Read only when the detail tier is sent. Keeping only the administrative class drops detail that names people."),
 });
 /**
  * The projection a destination that has declared nothing receives: everything.