{
  "$schema": "https://trustvice.com/schemas/data-access-providers/v1.json",
  "x-trustvice-policy": "https://github.com/99industries/trustvice-audit/blob/main/docs/audit/37-customer-first-data-access-policy.md",
  "x-trustvice-status": "published",
  "x-trustvice-note": "Documents the two paths under which Trustvice operators may read customer data. Customer-facing dashboard at /app/account/support-access.",
  "paths": [
    {
      "id": "path_a_customer_approved",
      "label": "Customer-approved",
      "description": "Default path. No operator access without a customer-side grant. Grants may be customer-initiated (proactive) or admin-initiated (customer reviews + approves / restricts / denies). Time-boxed 15min – 72h, scope-bounded, request-budget-bounded, instantly revocable.",
      "ttlMs": {
        "min": 900000,
        "max": 259200000
      },
      "maxRequests": {
        "default": 1000,
        "maximum": 5000
      },
      "notificationBefore": false,
      "notificationAfter": "real-time-on-session-start",
      "customerVeto": "instant",
      "customerVisibleSurface": "/app/account/support-access",
      "audit": "Hash-chained custody entries written into customer's audit log before every Worker handler runs."
    },
    {
      "id": "path_b_legal_override",
      "label": "Legal/fraud override",
      "description": "Narrow carve-out. Requires (1) documented external trigger (subpoena · regulator case ref · safety report · corroborated fraud signal · unreachable customer during incident) and (2) three-party WebAuthn sign-off (CISO + Counsel + CEO). Default TTL 24h, max 7d, no silent extensions.",
      "ttlMs": {
        "default": 86400000,
        "max": 604800000
      },
      "maxRequests": {
        "default": 5000,
        "maximum": 5000
      },
      "triggers": [
        "subpoena",
        "regulatory_request",
        "safety_review",
        "fraud_review",
        "incident_response"
      ],
      "signoffs": [
        "ciso",
        "counsel",
        "ceo"
      ],
      "notificationBefore": false,
      "notificationAfter": "immediate-or-deferred (deferral permitted only by court-order gag clause + recorded + auto-released when prohibition expires)",
      "customerVeto": "honored unless trigger explicitly prohibits (surfaced verbatim to customer)",
      "customerVisibleSurface": "/app/account/support-access (legal-override history panel) + annual transparency report",
      "audit": "Append-only `legal_override_records` table + hash-chained custody entries on every read; transparency-bucket aggregation published at /transparency/<year>.json"
    }
  ],
  "nonNegotiable": true,
  "relaxRequires": "board approval per audit policy 37 §10"
}