Governance that shows its work.

Central decisions (PDP) + per‑field obligations (PEP) at resolve time. Same query, different answers by role, attributes, and risk. Everything is recorded in spans you can audit.

Role outcomes: Analyst vs Admin

AI disabled (analyst policy)

{
  "allow": true,
  "obligations": {
    "allowFields": ["id","department","userId","total"],
    "features": {"ai": false},
    "mask": []
  },
  "policyEtag": "v1",
  "reason": "analyst masked read",
  "resource": {"type":"GraphQuery","name":"orders"}
}

Analyst sees only safe fields. AI features are off by policy.

AI enabled (admin permitted)

{
  "allow": true,
  "obligations": {
    "allowFields": ["*"],
    "features": {"ai": true},
    "mask": []
  },
  "policyEtag": "v1",
  "reason": "admin full access",
  "resource": {"type":"GraphQuery","name":"orders"}
}

Admin can see all fields (including PII if policy permits). AI features are on.

DSAR lifecycle: export & delete

Create requests (export/delete) per tenant/workspace. Requests are queued, executed, and tracked.

List requests with status, timestamps, and downloadable artifacts.

POST /compliance/:tenant/:workspace/dsar         # create export/delete
GET  /compliance/:tenant/:workspace/dsar         # list requests
GET  /compliance/:tenant/:workspace/dsar/:id/artifact  # download export

Audit you can trust: decisions inside spans

Spans carry PDP decision tags: allow, reason, resource, tenant, workspace, errors, etc.

{
"apigql.pdp.action": "read",
"apigql.pdp.allow": true,
"apigql.pdp.reason": "admin full access",
"apigql.pdp.resource.type": "GraphQuery",
"apigql.pdp.resource.name": "orders"
}