AgentTrust Docs

Open in ChatGPT

Standard: ISO/IEC 42001:2023 Clause 8.3, Annex A.6.2; GDPR Articles 5, 13, 17, 20 Document owner: Data Protection Officer Review cadence: Annually; after any data breach; after new data type introduced Classification: Internal — Restricted

1. Data Categories and Classification

Category	Examples	Classification	Retention
Agent execution metadata	agent_id, framework, version, timestamp	Internal	7 years
Request input (user text)	User query text (up to 16KB)	Confidential	90 days hot; archive 7 years
Agent output	Structured output dict (up to 100KB)	Confidential	90 days hot; archive 7 years
Execution details	Tool calls, tool results, model, tokens	Confidential	90 days hot; archive 7 years
Validation scores	confidence, risk tier, policy flags	Internal	7 years
Audit ledger hashes	SHA-256 content hash, chain hash	Internal	Permanent (integrity record)
PII detected in payloads	SSN, email, password, API key patterns	Sensitive	Mask within 24h; purge from hot store after 30 days
Feedback reports	Adverse impact descriptions	Confidential	3 years
Review queue entries	Reviewer notes, decision overrides	Confidential	3 years

2. Legal Basis for Processing

Processing Activity	Legal Basis (GDPR Art. 6)	Notes
Storing execution audit records	Art. 6(1)(b) — contract performance	Required to deliver governance service
Monitoring for policy violations	Art. 6(1)(f) — legitimate interests	Fraud prevention; safety
PII detection and alerting	Art. 6(1)(c) — legal obligation	Compliance with data protection law
Sending to LLM judge (Claude API)	Art. 6(1)(b) — contract performance	Covered by Data Processing Agreement with Anthropic
Adverse impact feedback reports	Art. 6(1)(f) — legitimate interests	Continuous improvement obligation under ISO 42001

3. Data Minimisation

The following data minimisation rules apply:

Request input: stored as-is (up to 16KB). PII detected by policy engine triggers an alert; PII fields are masked in the hot store within 24 hours.
Agent output: stored as-is (up to 100KB). Operators should redact PII before submitting output to the gateway where possible.
LLM judge prompts: the judge prompt includes only agent_id, framework, request.input[:500] (truncated), and output[:1000] (truncated). Full output is never sent to the external LLM API.
Adverse impact reports: affected_party must not contain PII (names, email, IDs that resolve to individuals); use role or pseudonymous identifiers.

4. Retention and Archival

4.1 Hot Store (PostgreSQL)

Execution records with full payload: 90 days
After 90 days: payload fields (request_json, execution_json, output_json) are nullified; metadata fields retained for 7 years
PII-flagged records: payload fields masked within 24 hours of detection

4.2 Archive Store (Object Storage — S3 / GCS)

Full records archived at 90-day rotation: encrypted at rest (AES-256)
Retained for 7 years from creation date
Format: line-delimited JSON; one file per day per deployment_env
Access: requires dual approval (DPO + Platform Lead)

4.3 Audit Chain Hashes

ledger_hash and content_hash: permanent (required for hash chain integrity verification)
These fields contain no personal data

4.4 Feedback Reports

Retained for 3 years after resolution

5.1 Right of Access (Art. 15)

Endpoint: GET /v1/audit/executions?agent_id={id} — returns all executions for an agent. Operators must handle data subject access requests within 30 days.

5.2 Right to Erasure (Art. 17)

PII within payloads can be erased without deleting the audit record:

Use DELETE /v1/audit/executions/{id}/pii (planned — see roadmap)
Hash chain metadata is NOT erasable (required for ledger integrity)
Audit chain hashes contain no personal data; erasure of payload fields is sufficient

5.3 Right to Data Portability (Art. 20)

Endpoint: GET /v1/audit/executions/export?format=json — returns all records for the requesting organisation in machine-readable format.

5.4 Right to Rectification (Art. 16)

Execution records are append-only. Corrections are issued as new records with parent_envelope_id referencing the original. The original record is retained for integrity.

Recipient	Data Shared	Safeguard
Anthropic (Claude API)	Truncated request input + output (judge prompt only)	Data Processing Agreement; Standard Contractual Clauses for cross-border transfer
Ollama (self-hosted)	Same as above	Self-hosted; no external transfer
Webhook recipients	Event type + envelope_id + decision (no payload)	HMAC-signed; operator-configured URLs only
Object storage (archive)	Full encrypted records	Encryption at rest; access control; same jurisdiction

7. Encryption Requirements

Data State	Requirement
In transit	TLS 1.2+ (enforced by ingress)
At rest — PostgreSQL	Disk-level encryption (cloud provider managed key or LUKS)
At rest — Redis	Disk-level encryption; password-protected
At rest — object storage	AES-256; customer-managed key (KMS) for sensitive archives

8. Roles and Responsibilities

Role	Responsibility
Data Protection Officer	Policy ownership; breach notification; DSAR handling
Platform Engineering Lead	Technical controls implementation; encryption; access controls
AI Governance Lead	Data category decisions; retention review; third-party assessment
On-call Engineer	PII alert response; masking procedures

9. Document History

Version	Date	Author	Changes
1.0	[DATE]	[NAME]	Initial version

Data Governance Policy