[VS-NfD] Make the read trail switchable and document its purpose limitation #225

New Issue

fable-5 · 2026-07-30T01:43:54+02:00

fable-5 commented

2026-07-30 01:43:54 +02:00

Plan reference: 20-massnahmenplan.md -> Phase 3, Variante A
ADR: ADR 0023
Effort: M (1–2 AT)
Depends on: #222, #224

Context

Read logging is employee monitoring in the eyes of a works council. A hard
switch plus a written purpose limitation is what makes it adoptable — the
plan names this as an explicit benefit of Variant A.

Current state

Not applicable — the feature arrives with #222.

Acceptance criteria

An instance switch enables/disables the trail; off means no event is
written anywhere (including stdout), verified by test.
Default is documented and deliberate.
A written purpose limitation states: what is recorded, why, who may
read it, for how long, and what it may not be used for.
The absence of events while switched off is itself explainable (a
startup log line stating the trail is off), so a gap is never
ambiguous.
Text ships as part of the security documentation (#228) and is
referenced from the hardening guide (#227).

Out of scope

Four-eyes access control on the trail, and works-council templates.

**Plan reference:** `20-massnahmenplan.md` -> Phase 3, Variante A **ADR:** ADR 0023 **Effort:** M (1–2 AT) **Depends on:** #222, #224 ## Context Read logging is employee monitoring in the eyes of a works council. A hard switch plus a written purpose limitation is what makes it adoptable — the plan names this as an explicit benefit of Variant A. ## Current state Not applicable — the feature arrives with #222. ## Acceptance criteria - [ ] An instance switch enables/disables the trail; off means no event is written anywhere (including stdout), verified by test. - [ ] Default is documented and deliberate. - [ ] A written purpose limitation states: what is recorded, why, who may read it, for how long, and what it may **not** be used for. - [ ] The absence of events while switched off is itself explainable (a startup log line stating the trail is off), so a gap is never ambiguous. - [ ] Text ships as part of the security documentation (#228) and is referenced from the hardening guide (#227). ## Out of scope Four-eyes access control on the trail, and works-council templates.

fable-5 added this to the M29 — VS-NfD: read-access audit trail milestone 2026-07-30 01:43:54 +02:00

fable-5 added the

area:docs

vs-nfd

effort:M

labels 2026-07-30 01:43:54 +02:00

fable-5 referenced this issue from a commit

2026-07-31 12:25:23 +02:00

#225: read-trail master switch and written purpose limitation

fable-5 referenced this issue

2026-07-31 12:25:54 +02:00

#225: read-trail master switch and purpose limitation #281

fable-5 referenced this issue from a commit

2026-07-31 12:33:08 +02:00

#225: read-trail master switch and written purpose limitation

fable-5 referenced this issue from a commit

2026-07-31 12:35:21 +02:00

#225: read-trail master switch and written purpose limitation

fable-5 commented

2026-07-31 12:59:08 +02:00

Implemented in PR #281 (commit 4af5e6e), merged fast-forward (run 596 green); CD 599 green, readyz test+int ok. readTrail.enabled default OFF (works-council rationale documented); off writes nothing anywhere - no row, no stdout line (tested via logger spy); the api announces the switch position each boot so an eventless trail is never ambiguous (boot must never fail on an unreachable database - tested). Written purpose limitation ships as section 7 of the VS-NfD security documentation (what is recorded, why, who may read, how long, what it may NOT be used for); the hardening guide reference configuration sets true and points there.

Implemented in PR #281 (commit 4af5e6e), merged fast-forward (run 596 green); CD 599 green, readyz test+int ok. readTrail.enabled default OFF (works-council rationale documented); off writes nothing anywhere - no row, no stdout line (tested via logger spy); the api announces the switch position each boot so an eventless trail is never ambiguous (boot must never fail on an unreachable database - tested). Written purpose limitation ships as section 7 of the VS-NfD security documentation (what is recorded, why, who may read, how long, what it may NOT be used for); the hardening guide reference configuration sets true and points there.

fable-5 closed this issue

2026-07-31 12:59:08 +02:00

Sign in to join this conversation.