Data governance contract
Data governance contract for Q integrations.
Q applies the same operator-managed data policy to REST/SDK requests, MCP tools, A2A-backed execution and workers through shared provider, outbound, cache and data services. This release adds no public governance endpoints; export/erasure is an operator procedure in the runbook.
DATA_GOVERNANCE_POLICY defines platform restrictions and DATA_GOVERNANCE_TENANTS adds restrictions by authenticated tenant. A tenant cannot widen platform permissions. Missing allow-lists impose no additional restriction; empty lists deny. Invalid configuration fails closed. Both policies must explicitly set training_opt_in or evaluation_opt_in to true for that use. An empty legacy TRAINING_OPT_IN_TENANTS no longer allows everyone; the new governance settings are authoritative.
| Field | Behaviour |
|---|---|
providers | Permitted provider IDs for credential resolution, completions and embeddings. Custom endpoints require operator attestation; library-owned routing overrides/fallbacks are rejected. |
regions | Requires an explicit endpoint in DATA_GOVERNANCE_DESTINATIONS with an allowed region. Default/unknown endpoints fail; client-supplied metadata cannot attest a region. |
external_origins | Exact origins permitted for MCP, connectors, external agents, fetches, hooks and callbacks. Existing outbound URL/DNS controls also apply. |
cache_enabled, cache_seconds | Reuse permission and maximum local cache lifetime; default 86,400 seconds, maximum 604,800. Policy/tenant identity separates cache entries. |
log_days | Stored request/provider diagnostic metadata lifetime, 0–30 days; default 7. Zero suppresses new rows. Console/exporter sinks need an operator-managed lifecycle. |
trace_days | Structured operational trace lifetime, 0–90 days; default 30. Zero suppresses new traces. |
training_opt_in, evaluation_opt_in | Separate use permissions, default false. Revocation is checked before use/export and queued quality judging. |
Policy denials use the shared error envelope: data_provider_denied, data_region_denied, data_destination_denied, data_destination_unverified, data_identity_required, governance_identity_mismatch, or data_use_not_consented. Invalid policy produces data_policy_invalid / HTTP 503. Do not retry a policy rejection as a new operation to bypass it. SDKs expose these through their normal error contracts.
Diagnostic bodies, arbitrary metadata/tags and exception values are no longer retained in new request/provider logs. Console logs identify source locations and exception classes; correlate using the SHA-256 hash of an identifier. This intentionally reduces diagnostic detail. Use an authorised, retention-bound operational trace when content is needed. Historical log bodies are not returned by request-log APIs and require physical cleanup during rollout.
Legacy unscoped edit, reranker, compaction, session and RL collectors cannot accept production tenant data. DATA_GOVERNANCE_SYNTHETIC_EXPERIMENTS=true enables these formats only in development/test without tenant identity. Tenant-aware training export uses current consent and excludes other tenants and expired traces. Exported datasets and already-trained models require separately tracked revocation/deletion work; Q does not claim model unlearning.
Source-linked erasure removes all three chunk formats and known artefact/memory derivatives. It preserves a permanent source fence and an immutable receipt. Completion remains pending until original objects, cache copies, untraced historical content, external systems and backups have evidence. Configured provider regions are operator attestations, not independent residency certification. Retention maintenance and backup procedures are deployment obligations described in the runbook.