Works-Council-Visible-or-Blocked: A Fail-Closed Oversight Gate for Personal-Data Flows Between Nodes
Abstract
Disclosed is the concrete arrangement by which a system makes every cross-node personal-data flow visible to employee representatives before the flow occurs, and blocks the flow when that visibility cannot be established. The arrangement combines: a machine-checked data class that fails closed to personal; a co-determination flag carried at flow granularity by the bilateral relationship grant; a non-downgrade rule under which neither the classifier nor the flag can remove a non-empty flow from oversight visibility, so that classifier blind spots cannot open the gate; exactly one oversight record per flow, enforced by a uniqueness constraint on the flow's correlation identity with an idempotent-on-conflict write that reports whether it truly inserted, so that a retry neither duplicates the record nor re-appends the audit entry; the oversight write awaited before any delivery or storage; a redacted, metadata-only oversight record that survives erasure of the content it describes; and integrity constraints that make a malformed oversight record unwritable. Also disclosed is the data-level conformance check that catches what code inspection misses: no admitted personal flow exists anywhere without its oversight record, and a blocked flow leaves zero rows everywhere.
Creative Commons License
This work is licensed under a Creative Commons Attribution 4.0 License.
Recommended Citation
Bering, Alexander, "Works-Council-Visible-or-Blocked: A Fail-Closed Oversight Gate for Personal-Data Flows Between Nodes", Technical Disclosure Commons, ()
https://www.tdcommons.org/dpubs_series/11254