{
  "id": "compliance_legal_guardrails",
  "label": "Compliance / Legal Guardrails Canonical",
  "phase": "phase-08",
  "category": "security_governance",
  "status": "ACTIVE_DH_MIRROR",
  "purpose": "Define the minimum compliance and legal guardrails DEVON-DEV must respect before sensitive files, logs, secrets, credentials, client data, retained records, masked outputs or access decisions are stored, displayed, indexed, reused or transmitted.",
  "function": "Convert compliance from after-the-fact review into an execution guardrail by blocking or constraining sensitive data exposure in files, logs, prompts, UI, evidence, memory, external knowledge flows, retention windows and access decisions.",
  "compliance_contract": {
    "requires_sensitive_data_classification": true,
    "requires_client_data_flag": true,
    "requires_secret_and_credential_policy": true,
    "requires_log_safety_policy": true,
    "requires_prompt_reuse_policy": true,
    "requires_retention_rule": true,
    "requires_masking_rule": true,
    "requires_access_policy": true,
    "requires_external_transmission_policy": true,
    "requires_audit_reference": true,
    "requires_legal_risk_state": true,
    "blocks_sensitive_log_exposure": true,
    "blocks_unmasked_sensitive_ui_display": true,
    "blocks_unapproved_sensitive_prompt_use": true,
    "blocks_retentionless_sensitive_storage": true,
    "blocks_unapproved_external_transmission": true,
    "blocks_unknown_client_data_handling": true,
    "decision_authority": "NONE_FSM_DECIDES"
  },
  "guarded_surfaces": [
    "files",
    "logs",
    "secrets",
    "credentials",
    "client_data",
    "uploads",
    "evidence_snapshots",
    "prompt_context",
    "model_outputs",
    "memory_records",
    "indexed_content",
    "ui_panels",
    "exports",
    "external_transmission",
    "retained_records"
  ],
  "technology_requirements": [
    {
      "technology": "Compliance Guardrails Engine",
      "required_for": "Evaluate sensitive data, retention, masking, access, prompt reuse, UI display, logging and external transmission guardrails before DEVON-DEV exposes or reuses governed material.",
      "required_by_phase": "phase-08",
      "required_by_category": "compliance_legal_guardrails",
      "required_by_buckets": [
        "Prerequisites",
        "Installation",
        "Configuration",
        "Validation",
        "Observable Evidence",
        "Failure Modes & Recovery",
        "Completion & Promotion"
      ],
      "expected_version": "MISSING until guardrail policy schema and enforcement path exist",
      "validation_command": "MISSING until compliance check can prove data_class, surface, policy, allow/deny result, masking action, retention class and audit reference",
      "evidence_path": "/home/yeff/public_html/devon/canon/execution/state/dh_sources/compliance_legal_guardrails_canonical.json",
      "status_source": "Documentation Hub + future Security & Risk Engine + Data Governance + Audit Trail Store",
      "blocking_if_missing": true,
      "failure_impact": "Without Compliance Guardrails Engine, DEVON-DEV can correctly execute technical work while exposing sensitive or legally constrained material through logs, prompts, UI, memory or external flows."
    },
    {
      "technology": "Sensitive Data Detector",
      "required_for": "Detect sensitive files, credentials, client data, private project content, regulated identifiers and confidential outputs before storage, logging, prompt use, UI display or external transmission.",
      "required_by_phase": "phase-08",
      "required_by_category": "compliance_legal_guardrails",
      "required_by_buckets": [
        "Installation",
        "Configuration",
        "Validation",
        "Observable Evidence",
        "Failure Modes & Recovery"
      ],
      "expected_version": "MISSING until sensitive detection rules and scanning path exist",
      "validation_command": "MISSING until detector can prove input surface, sensitivity class, match result, masking requirement and compliance decision",
      "evidence_path": "/home/yeff/public_html/devon/canon/execution/state/dh_sources/compliance_legal_guardrails_canonical.json",
      "status_source": "Documentation Hub + future Data Governance + Security Monitoring + Execution Logs",
      "blocking_if_missing": true,
      "failure_impact": "Without Sensitive Data Detector, compliance depends on humans noticing sensitive material after it has already entered unsafe surfaces."
    },
    {
      "technology": "Data Masking",
      "required_for": "Mask sensitive values before they appear in logs, UI, prompt context, exports, reports, evidence snapshots, memory records or model-visible material.",
      "required_by_phase": "phase-08",
      "required_by_category": "compliance_legal_guardrails",
      "required_by_buckets": [
        "Configuration",
        "Validation",
        "Observable Evidence",
        "Failure Modes & Recovery"
      ],
      "expected_version": "MISSING until masking rules, field policies and output filters exist",
      "validation_command": "MISSING until masking check can prove raw input class, masked output, rule applied, destination surface and no raw sensitive exposure",
      "evidence_path": "/home/yeff/public_html/devon/canon/execution/state/dh_sources/compliance_legal_guardrails_canonical.json",
      "status_source": "Documentation Hub + future Data Masking Engine + Execution Logs + Prompt Governance",
      "blocking_if_missing": true,
      "failure_impact": "Without Data Masking, DEVON-DEV can identify sensitive data and still leak it through diagnostics, UI rendering, prompt assembly or evidence display."
    },
    {
      "technology": "Retention Rules",
      "required_for": "Control how long sensitive files, logs, evidence, memory records, prompt context, uploads, audit records and derived outputs are kept or deleted.",
      "required_by_phase": "phase-08",
      "required_by_category": "compliance_legal_guardrails",
      "required_by_buckets": [
        "Configuration",
        "Validation",
        "Observable Evidence",
        "Failure Modes & Recovery",
        "Completion & Promotion"
      ],
      "expected_version": "MISSING until retention classes, deletion rules and protected record categories exist",
      "validation_command": "MISSING until retention check can prove data_class, retention_window, legal_hold_status, deletion_rule, deletion_result and audit record",
      "evidence_path": "/home/yeff/public_html/devon/canon/execution/state/dh_sources/compliance_legal_guardrails_canonical.json",
      "status_source": "Documentation Hub + future Retention Policy Registry + Volume & Persistence Governance + Audit Trail Store",
      "blocking_if_missing": true,
      "failure_impact": "Without Retention Rules, DEVON-DEV can delete legally relevant evidence too early or keep sensitive material longer than the project allows."
    },
    {
      "technology": "Access Policy",
      "required_for": "Define who, which role, which project, which tool and which runtime flow may view, reuse, export, prompt-use, index or delete sensitive and compliance-governed data.",
      "required_by_phase": "phase-08",
      "required_by_category": "compliance_legal_guardrails",
      "required_by_buckets": [
        "Prerequisites",
        "Configuration",
        "Validation",
        "Observable Evidence",
        "Failure Modes & Recovery",
        "Completion & Promotion"
      ],
      "expected_version": "MISSING until compliance-aware access policy and enforcement point exist",
      "validation_command": "MISSING until access policy can prove actor, role, project_id, data_class, requested_surface, allow/deny result and audit record",
      "evidence_path": "/home/yeff/public_html/devon/canon/execution/state/dh_sources/compliance_legal_guardrails_canonical.json",
      "status_source": "Documentation Hub + future RBAC Service + Data Governance + Audit Trail Store",
      "blocking_if_missing": true,
      "failure_impact": "Without Access Policy, sensitive data can be protected by classification but still viewed, reused or exported by the wrong actor or tool path."
    },
    {
      "technology": "Legal Risk Register",
      "required_for": "Record compliance-sensitive decisions, unknown legal posture, restricted-use material, client-data handling exceptions and legal-risk review status.",
      "required_by_phase": "phase-08",
      "required_by_category": "compliance_legal_guardrails",
      "required_by_buckets": [
        "Configuration",
        "Validation",
        "Observable Evidence",
        "Failure Modes & Recovery",
        "Completion & Promotion"
      ],
      "expected_version": "MISSING until legal risk states and review records exist",
      "validation_command": "MISSING until legal risk record can prove data/material class, risk_state, reviewer/gate, decision, evidence_path and timestamp",
      "evidence_path": "/home/yeff/public_html/devon/canon/execution/state/dh_sources/compliance_legal_guardrails_canonical.json",
      "status_source": "Documentation Hub + future Legal Risk Register + Audit Trail Store + Architecture Source Registry",
      "blocking_if_missing": false,
      "failure_impact": "Without Legal Risk Register, ambiguous compliance decisions remain hidden in execution history instead of becoming explicit governance records."
    }
  ],
  "depends_on": [
    "sec",
    "rbac_permissions",
    "secrets_management",
    "multi_project_isolation",
    "data_governance",
    "license_third_party_governance",
    "execution_ledger",
    "execution_logs",
    "audit_trail",
    "evidence_store",
    "source_trust_registry",
    "prompt_governance",
    "prompt_instruction_assembly",
    "external_knowledge_access",
    "fsm_absolute_decision",
    "decision_rule_registry",
    "architecture_source_registry"
  ],
  "used_by": [
    "dependency_vulnerability_scanner",
    "license_third_party_governance",
    "security_monitoring",
    "host_security",
    "app_security",
    "runtime_security",
    "delivery_security",
    "memory_arch",
    "knowledge_ingestion",
    "knowledge_versioning",
    "learning_gov",
    "external_knowledge_access",
    "future_execution_monitoring_panel"
  ]
}