BAT-017: Import provenance and sensitive-data policy

Profile: standard
Status: draft
Included REQ: REQ-021
Source Discovery: dcy-014
Created At (KST): 2026-07-08 11:33 KST

Objective

Deliver the approved REQ-021 scope for normalized import provenance, raw_payload=minimize, masked filename + source hash, MCP provenance exposure levels, finance-agent privacy boundary, destructive migration guardrails, and baseline documentation.

Included Scope

Source-specific provenance envelope for KB Bank PDF, Toss Bank PDF, Toss Securities PDF, SeoulPay XLSX, and CSV preview/import surfaces.
transactions.raw_payload minimize policy using explicit allowlists and forbidden-field filtering.
import_batches.filename policy change away from full paths toward masked basename + source hash.
MCP/Streamlit provenance exposure levels: default minimal, operator operator-summary, debug debug-gated.
Sensitive-field tests/static checks for raw payload, full paths, password/token/secret, raw document text, and arbitrary CSV column leakage.
Baseline updates in docs/data-model.md, docs/project-structure.md, and docs/runtime-flows.md.

Excluded Scope

Existing operating DB sanitization migration; tracked separately in GitHub Project 4 Todo 기존 운영 DB import evidence sanitization preview 및 정리.
External legal/security audit.
Original source document vault/encryption system.
Public API auth/TLS design.
Kanban-based delivery execution.

Documents

Delivery Notes

User explicitly prohibited Kanban; delivery execution must use direct branch/PR or a dedicated non-Kanban worktree if delegated.
Implementation should be sliced to avoid the previous BAT-016 large-card failure pattern: provenance helpers first, source adapters second, MCP/Streamlit exposure third, tests/docs last.

1.9 KiB Raw Blame History