Status. Proposed design only. Nothing in this vault is DG client approval. No application, service or test has been executed; every scenario is Not executed. Fees and dates are open.
DG22 · Opaque IDs do not grant named private oversight
| Field | Value |
|---|---|
| Status | Not executed |
| Type | Balanced boundary (checks a limit of Balanced) |
| Layer / kind | Balanced boundary · API/security |
| Priority | — |
| Gates | S03, S07 |
| Build step | Step-03-Policy-Pipeline-and-Isolation-Harness |
| Decisions | Q08, Q16 |
Given
DG has candidate Q08 metadata; rare timestamps/IDs can correlate A-B activity; private canaries exist.
When
Attempt metadata-to-company joins, named overdue query and per-client receipt cross-reference.
Then / oracle
No unapproved crosswalk, private bodies, contacts, decline reasons or named queue. Ordinary metadata itself waits Q08 approval. Member-visible content and separately supplied manual contacts do not authorise private-state joins. Opacity is not assumed anonymity.
Evidence required
Field/route allow-deny matrix and negative canary tests linked to T10/T27/T28; manual receipt correlation review.
Decision dependency (verbatim)
Q08/Q16: metadata, identifier and access/retention policy; no default reporting entitlement.
Source: TDD rev 1.3 (PDF); machine-readable in 10-Sources/tdd-bundle/. Back to Scenario-Index · Traceability-Matrix · integration dependencies in Dependency-and-Regression-Table.