Renata protected actor schema planning

Actor Reference Schema Planning

Protected, read-only schema planning for future opaque actor references before storage, migrations, or live workflows exist.

This is a protected, read-only actor-reference schema planning page. It does not create actor records, store identities, map real users, assign roles, collect submissions, create tables, or write data.

Purpose

This page defines the planned schema boundaries for future pseudonymous actor references without creating tables, migrations, runtime queries, or actor records.

It is schema planning only. Planned tables are metadata, not D1 tables, not migrations, and not runtime storage.

Current Identity Boundary

Product

Renata

The Sixth Sense at 6th Street

Access boundary

outer-boundary-only

outer-boundary-only

Actor storage

false

not implemented

SQL migrations

false

not added

Actor reference schema is metadata only; no actor records, identity maps, accounts, roles, submissions, tables, migrations, or writes exist.

Why Actor-Reference Schema Comes Before Storage

Actor references are identity-adjacent even when opaque. Planning fields, relationships, lifecycle labels, audit requirements, retention, deletion, and exclusions before storage keeps the future model from accidentally becoming identity mapping, tracking, analytics, or scoring.

This phase does not create a database table, run a migration, add a write endpoint, or create any actor reference.

Planned Tables

Table Purpose Status Sensitivity Fields Activation gates Launch blockers
future_actor_refs stores opaque pseudonymous actor references only, not real identities planned-only identity-adjacent-configuration-sensitive id, community_id, actor_ref, actor_ref_type, actor_scope, actor_status, actor_version, created_at, updated_at, retired_at, revoked_at identity policy approved; actor mapping policy approved; role mapping policy approved; retention policy approved; deletion policy approved; audit policy approved; staff review procedure approved; privacy approval complete; small pilot approved; schema review complete; migration readiness review complete no actor storage exists; no identity mapping exists; no account model exists; no role assignment model exists; no draft schema is approved; no staff review procedure is approved; no retention/deletion policy is approved; no audit policy is approved; no active migration is approved; no database write path is approved
future_actor_ref_contexts stores workflow/community context for actor references without identity linkage planned-only workflow-context-sensitive id, actor_ref, community_id, workflow_context, actor_scope, created_at, updated_at identity policy approved; actor mapping policy approved; role mapping policy approved; retention policy approved; deletion policy approved; audit policy approved; staff review procedure approved; privacy approval complete; small pilot approved; schema review complete; migration readiness review complete no actor storage exists; no identity mapping exists; no account model exists; no role assignment model exists; no draft schema is approved; no staff review procedure is approved; no retention/deletion policy is approved; no audit policy is approved; no active migration is approved; no database write path is approved
future_actor_ref_status_history stores planned lifecycle transitions such as planned, active-in-pilot, retired, replaced, or revoked planned-only lifecycle-audit-sensitive id, actor_ref, actor_status, actor_version, replacement_actor_ref, status_reason, created_at, retired_at, revoked_at identity policy approved; actor mapping policy approved; role mapping policy approved; retention policy approved; deletion policy approved; audit policy approved; staff review procedure approved; privacy approval complete; small pilot approved; schema review complete; migration readiness review complete no actor storage exists; no identity mapping exists; no account model exists; no role assignment model exists; no draft schema is approved; no staff review procedure is approved; no retention/deletion policy is approved; no audit policy is approved; no active migration is approved; no database write path is approved
future_actor_ref_audit_events stores future audit metadata about actor-reference changes, without storing real identity planned-only audit-sensitive id, conceptual_actor_ref, audit_event_type, audit_reason_code, workflow_context, created_at identity policy approved; actor mapping policy approved; role mapping policy approved; retention policy approved; deletion policy approved; audit policy approved; staff review procedure approved; privacy approval complete; small pilot approved; schema review complete; migration readiness review complete no actor storage exists; no identity mapping exists; no account model exists; no role assignment model exists; no draft schema is approved; no staff review procedure is approved; no retention/deletion policy is approved; no audit policy is approved; no active migration is approved; no database write path is approved

Planned Field Map

idcommunity_idactor_refactor_ref_typeactor_scopeworkflow_contextactor_statusactor_versionreplacement_actor_refcreated_atupdated_atretired_atrevoked_atstatus_reasonaudit_event_typeaudit_reason_codeconceptual_actor_ref
  • actor refs must be opaque and non-semantic
  • actor refs must not contain names, initials, email fragments, room numbers, case numbers, or identity hints
  • conceptual_actor_ref must not store real identity or Access claims
  • community_id is planning metadata only and must not imply a live tenant/account table in this phase
  • workflow_context is planning metadata only and must not enable live workflow routing in this phase

Relationship Map

Relationship Status Allowed future use Blocked relationships
actor ref to community context planned-only Could scope an opaque actor ref to an approved community context after policy approval. real email; real name; Cloudflare claim; resident profile
actor ref to workflow context planned-only Could keep actor refs separated by workflow family so draft, review, and audit contexts do not over-link. staff profile; attendance record; participation analytics; scoring or compliance metric
actor ref to future draft author reference planned-only Could support a future approved pull-up/push-up draft author reference after all live draft gates. real email; real name; Cloudflare claim; submission content
actor ref to future subject reference planned-only Could support future staff-reviewed subject routing after privacy and visibility approval. resident profile; case number; staff profile; behavior history
actor ref to future reviewer reference planned-only Could support future audit metadata for staff review without storing reviewer identity values. staff name; staff email; Cloudflare Access group; staff surveillance dashboard
actor ref to future audit actor reference planned-only Could support future lifecycle audit metadata after audit and retention policy approval. raw Access claims; JWT; token; identity header

Lifecycle States

planned

does not trigger behavior

metadata-only

synthetic-preview

does not trigger behavior

metadata-only

privacy-review-required

does not trigger behavior

metadata-only

pilot-ready

does not trigger behavior

metadata-only

active-in-pilot

does not trigger behavior in this phase

metadata-only

retired

does not trigger behavior

metadata-only

replaced

does not trigger behavior

metadata-only

revoked

does not trigger behavior

metadata-only

Excluded Identity and Sensitive Fields

emailnamefirst namelast nameinitialsphoneaddressroom numbercase numberlegal identifiermedical identifierinsurance identifierCloudflare identity headerCloudflare Access emailCloudflare Access groupJWTtokengroup claimraw Access claimsresident profile fieldsstaff profile fieldsmedical detailsdiagnosis detailsmedication detailstrauma detailslegal detailsinsurance detailssubmission contentpull-up contentpush-up contentstaff review notesattendance dataparticipation dataparticipation analyticsscoring dataranking datadiscipline pointscompliance metricsresident performance metrics

Validation Rules

  • actor refs are opaque
  • actor refs contain no email/name/initials/identity hints
  • actor refs are scoped to community and workflow context
  • actor refs do not expose Cloudflare Access claims
  • actor refs do not create attendance tracking
  • actor refs do not create participation tracking
  • actor refs do not create participation analytics
  • actor refs do not create scoring/ranking/compliance metrics
  • actor refs cannot be used for live submissions until identity, role, retention, audit, deletion, staff review, and privacy gates are approved
  • actor refs cannot be exported without staff/privacy approval

Audit Requirements

  • audit policy must exist before actor refs are stored
  • audit events must use conceptual_actor_ref only
  • audit events must not store email, name, Cloudflare claims, JWT, token, group, resident profile, or staff profile fields
  • audit events must distinguish planned, pilot-ready, retired, replaced, and revoked transitions
  • audit events must not become staff surveillance, participation analytics, scoring, or compliance reporting

Retention And Deletion Considerations

  • actor refs require retention windows before storage
  • actor refs require deletion rules before storage
  • replacement_actor_ref requires rollback and visibility rules before pilot use
  • retired and revoked states must not preserve identity mapping
  • status history must not become resident or staff history
  • audit events must have a retention boundary before writes exist

Required Gates Before Activation

  • identity policy approved
  • actor mapping policy approved
  • role mapping policy approved
  • retention policy approved
  • deletion policy approved
  • audit policy approved
  • staff review procedure approved
  • privacy approval complete
  • small pilot approved
  • schema review complete
  • migration readiness review complete

What Remains Blocked

  • app-level login
  • account creation
  • password fields
  • email capture
  • real user names
  • real resident names
  • real staff names
  • real emails
  • Cloudflare Access email display
  • Cloudflare Access name display
  • Cloudflare Access group display
  • Cloudflare Access JWT display
  • Cloudflare Access token display
  • Cloudflare Access header display
  • Cloudflare Access claim storage
  • actor records
  • actor storage
  • identity mapping records
  • resident profiles
  • staff profiles
  • user admin CRUD
  • role assignment
  • live pull-up forms
  • live push-up forms
  • submission collection
  • staff approval/rejection
  • Morning Sheet live placement
  • database writes
  • write endpoints
  • active migrations
  • SQL migration files
  • D1 account/user/actor/submission tables
  • attendance tracking
  • participation tracking
  • participation analytics
  • scoring, ranking, discipline points, or compliance metrics
  • billing, lead capture, CRM, Stripe, or sales forms
  • AI for real submissions
  • sensitive community content storage

Recommended Next Phase

Phase 8.4 - Account Role Mapping Schema Planning

After actor reference schema metadata is planned, the next safe step is planning account-role mapping boundaries without creating accounts, storage, role assignment, or live workflows.

Boundaries: no actor storage in Phase 8.3; no identity mapping yet; no accounts yet; no role assignment yet; no live submissions yet; no staff decisions; no database writes; no active migrations; no SQL migrations.

recommended-next