feat(sensitive): bind model disclosure to exact route policy

[seonghobae]

Partial implementation of #10, stacked on PR #69.

Buyer/security gap

Issue #10 requires AI-involved sensitive-data policy to bind selected provider/model/region plus retention and export behavior instead of treating possession of model credentials or an internal network location as disclosure authority. The sensitive-handle stack already provides exact authority/audience/lifecycle primitives; this Draft supplies a reusable deterministic route-admission prerequisite without creating a raw-value broker.

Dependency

This Draft is stacked on unchanged exact PR #69 head de79d85e6be5131036db119efab767f0eb76a816 and must remain Draft while #69/#68/#55/#53/#46 are active.

Implemented scope

Exact current head is 286f92aae9e298ab7dff1fd81c7850aabd5692ce.

The branch adds ModelRouteRequest / ModelRouteScope / ModelRouteDecision / evaluate_model_route and now binds the complete existing SensitiveDataAuthority tuple to exact bounded:

• provider;
• model;
• region;
• retention policy;
• training policy;
• reviewed-subprocessor policy; and
• export policy.

Existing new(...) callers default export policy to no-export; a caller that needs a separately governed export choice uses with_export_policy(...). Both request-side and scope-side identifiers are bounded 1–128 byte ASCII policy tokens with at least one alphanumeric character. Malformed request policy, malformed trusted scope, authority mismatch, or any route-dimension mismatch fails closed. Matching route metadata remains explicitly separate from protected-value disclosure and from actual export execution.

TDD / RCA sequence

1. Earlier route-policy work reached exact 100% production coverage after correcting malformed-scope tests that had short-circuited on malformed requests.
2. Export test-only head 90bde2dba675be10abb34a5c2a8bf03bb34abcdf established the intended missing-capability RED in CI run 31474208345, Rust contracts job 93724057066: repository contracts and rustfmt passed, then cargo check --locked --workspace --all-targets failed with E0599 because export-policy APIs did not exist.
3. Production head 88b1fd46b6d2e83411682f97aa17de95aca90789 made the export regressions GREEN, but strict Clippy correctly rejected the two new eight-argument constructors (clippy::too_many_arguments). That was treated as a product API design defect rather than bypassed with an allow attribute or weaker gate.
4. Head e0527ffe5e461db778f0eb7ac37d7e3b81e1a7c5 replaced the oversized constructors with the bounded builder-style with_export_policy selector while retaining a fail-safe no-export compatibility default.
5. Head a07e3eb33489e0ed26fdc2c381ae587edc41c503 updated the realistic export regressions to exercise that API, and current head 286f92aae9e298ab7dff1fd81c7850aabd5692ce adds the truthful Unreleased changelog entry.

Exact-current evidence

For exact head 286f92aae9e298ab7dff1fd81c7850aabd5692ce against unchanged exact stack base de79d85e6be5131036db119efab767f0eb76a816:

• CI run 31474904239: success;
• Rust contracts job 93726313815: success, including repository contracts, canonical formatting, locked workspace/all-target check, full tests, strict Clippy, and rustdoc;
• Production coverage job 93726313914: success, including exact owned production function/line/region/branch enforcement;
• GitHub reports this Draft mergeable against its exact prerequisite base; and
• no formal or inline review findings are currently returned for this exact head.

No predecessor-head check or review is transferred to the current head.

Truth boundary

This lane does not authenticate a provider, invoke a model, inspect or attest a real provider region, authorize raw-field disclosure, execute an export, bind a prompt/token budget, validate model output, persist policy, choose fallback providers, or claim the complete trusted broker/orchestrator. It is only the deterministic sensitive-data route-policy prerequisite for those later trusted boundaries.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 9a58c5ba-35d1-4a10-b8cf-79a546d3fceb

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}