- Shipped
- August 25, 2026 at 12:55 AM UTC
- Author
- Kamo
- Commit
- 8a8a9af
ANALYTICS_EXPORT is blocked because exports leave the boundary with no de-identification. Both training exports already had a fail-closed audit — there IS a record — but every line carries the extracted CONTENTS of a document and the export exists to train a model on them. A covered entity needs a Safe Harbor or Expert Determination path first, and neither exists. QcController.trainingExport is per-org. SystemConfigurationController's platform corpus deliberately crosses every tenant, so it uses assertPlatformWidePermitted: one covered entity anywhere on the deployment is enough to make an undifferentiated dump of everyone's document contents a disclosure. Both refusals land ahead of the repository read and the audit write. HMDA is deliberately NOT guarded here — it is a mortgage regulatory filing under MLOS, not an analytics export. 953 tests green, including two new refusal cases.