/**
 * Privacy Types — 审计层模块。
 *
 * 职责边界：
 * - 负责：SensitivityLabel 等 审计层职责
 * - 不负责：不属于本模块的职责由对应模块承担
 *
 * 被谁调用：发布门禁、质量检查
 * 调用谁：无外部依赖
 *
 * 数据流：审计输入（代码/配置） → 检查 → 评分/报告
 * 持久化：无持久化（纯计算/内存态）
 */
export type SensitivityLabel = "public" | "internal" | "confidential" | "secret" | "credential" | "pii" | "customer_data" | "production_data" | "unknown";
export type HandlingMode = "allow" | "redact" | "summarize_only" | "require_human" | "forbidden";
export type RedactionType = "secret_mask" | "credential_removed" | "pii_mask" | "customer_data_summary" | "production_data_summary" | "path_only" | "hash_only";
export type AllowedOperation = "read" | "summarize" | "redact" | "prompt_inject" | "store_private" | "external_send";
export type CheckContext = "prompt_injection" | "task_context_store" | "artifact_store" | "evidence_store" | "external_send" | "read_operation";
export interface DataSensitivityLabel {
    label: SensitivityLabel;
    source_ref: string;
    detected_by: string[];
    confidence: number;
    handling: HandlingMode;
}
export interface DataAccessGrant {
    grant_id: string;
    granted_by: string;
    scope_refs: string[];
    sensitivity_allowed: SensitivityLabel[];
    allowed_operations: AllowedOperation[];
    purpose: string;
    expires_at: string;
    revocable: boolean;
}
export interface RedactionRecord {
    source_ref: string;
    redaction_type: RedactionType;
    before_hash?: string;
    after_hash: string;
    fields_redacted: string[];
}
export interface PrivacyGovernanceFinding {
    severity: "hard_fail" | "advisory";
    rule: string;
    source_ref?: string;
    message: string;
}