Skip to content

Decide: data classification level for the ART extension #49

New issue
New issue
Closed
Closed
Decide: data classification level for the ART extension#49
Labels
artART framework extension workdecisionNeeds a product-owner decision before work starts
Milestone
ART extension

Description

@amar-python
amar-python
opened on Oct 25, 2026

Context

ART Framework v2 (D6, BR-37) requires that uploaded data, derived data and audit records stay inside the deployment boundary, with no runtime external services. The classification level itself was not set.

Decide

  • The classification level the platform must support (for example OFFICIAL, OFFICIAL: Sensitive, PROTECTED).
  • Retention and privacy rules for raw uploads and audit records.

Done when

The level and rules are recorded and reflected in the BR-37 VCRM row.

Activity

  1. amar-python
    added
    decisionNeeds a product-owner decision before work starts
    artART framework extension work
    on Oct 25, 2026

  2. amar-python commented on Oct 25, 2026

    @amar-python
    amar-python
    on Oct 25, 2026 – with Claude
    OwnerAuthor

    Automated verification: FAIL (verify_issues.py, 2026-10-25)

    no decision recorded: no comment from the owner and the issue is open

    Generated by Claude Code

  3. amar-python
    added this to the ART extension milestone on Oct 25, 2026

  4. amar-python commented on Oct 26, 2026

    @amar-python
    amar-python
    on Oct 26, 2026 – with Claude
    OwnerAuthor

    Decided 2026-10-26 (ART decision 7):

    • Design target: OFFICIAL: Sensitive.
    • Raw uploads: kept until a recorded purge.
    • Audit records: kept 7 years by default, configurable. Confirm against the client's records authority.
    • PROTECTED: remains a roadmap item, since it would add IRAP-assessed hosting and ISM PROTECTED controls.

    Recorded in DECISIONS/2026-10-26-art-milestone-0.md and reflected in BR-37 in docs/VCRM.md. Closing.

    Generated by Claude Code

  5. amar-python
    closed this as completedon Oct 26, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    artART framework extension workdecisionNeeds a product-owner decision before work starts

    Projects

    No projects

      Milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions