Status. Proposed design only. Nothing in this vault is GGA client approval. The GGA client documents are supplied drafts: see GGA-Source-Digest. No application, service or test has been executed; every scenario is Not executed. Delivery fees and dates are open.
T28 · DG operations do not grant private-message browsing
| Field | Value |
|---|---|
| Status | Not executed |
| Type | Balanced software |
| Layer / kind | API · security · audit |
| Priority | P0 |
| Gates | A06, A09 |
| Build step | 03 (GGA order; the 1.3 step is history) |
| Decisions | Q08 |
Disposition under GGA
| Field | Value |
|---|---|
| Disposition | Reframed |
| GGA basis | Blueprint pp. 3, 17 (GGA-Requirement-Register) |
| Replaced or carried by | GS17-staged, GS26-staged |
| Still open | none |
| What changes | DG operations become the operations owner, finance and technical roles with scoped access and no routine browsing of business data. |
The 1.3 text below is kept verbatim as history. Where the disposition is Reframed, Superseded or Parked it is not the GGA oracle; use the replacing scenario. A Parked scenario has no GGA feedback and stays a Proposed carry-forward. The status stays Not executed. Register: Scenario-Dispositions.
Given
DG has approved membership/operational tools and admin MFA; B/C private canaries exist.
When
DG opens routine metadata views and attempts private-body routes; exercise any expressly approved support-access path.
Then / oracle
Candidate routine DG allowlist: opaque record/event IDs, approved event/state labels and timestamps only. Exclude bodies, terms, decline reasons and contact data. Company/participant identifiers await Q08. Private-body routes deny by default. Any approved support exception is scoped, time-limited, authorised and audited; otherwise disabled.
Evidence required
Field-by-field metadata allow/deny tests; synthetic bodies/terms/reasons/contacts absent; support grant/revoke audit if approved.
Decision dependency (verbatim)
Q08: final metadata/identifier allowlist and support authoriser/scope/expiry. Candidate is not approved production data access.
Source: TDD rev 1.3 (PDF); machine-readable in 10-Sources/tdd-bundle/. Back to Scenario-Index · Traceability-Matrix · integration dependencies in Dependency-and-Regression-Table.