FIN Anonymization Policy v1

Date: 2026-05-15 Status: Draft v1.0.0 (effective when first public projection ships; Wave 3) Policy version: v1.0.0 Effective date: 2026-05-15 (Wave 3 gate) Related: docs/architecture/FIN_CENTRAL_TENANT_DEMARCATION_PLAN_2026-05-15.md, docs/engineering/FIN_INTRANET_HUMAN_AGENT_PROJECTION_ENGINEERING_SPEC_2026-05-13.md, docs/product/FIN_DATA_SIGNAL_OFFERINGS_2026-05-15.md

0. Purpose

This policy controls what data may cross the boundary from tenant-private storage into FIN Central, Harvest Directory (public mirror), Tier 0 public MCP, federal-audience projections, business intelligence subscriptions, and any other surface external to a tenant’s trust boundary.

It defines the field-level disposition for each data class: what is stripped, what is banded (numeric noise added), what is aggregated (combined across N sources), what is preserved, and what is never published under any circumstances.

This policy is a versioned, reviewable, auditable artifact. Every public projection records which policy version was applied. Every projection that emits to a non-tenant surface MUST cite this document or its successor.

1. Principles

1. Default deny. Fields not explicitly enumerated as preserved or transformed are stripped.
2. Anonymization happens at projection time, not at collection. Tenants retain full-fidelity raw data; public projections apply this policy before emission.
3. Provenance survives the gate. Public projections may cite “N observed events” without exposing event IDs or tenant identity.
4. Per-projection, per-tenant opt-in. No tenant data is published without explicit consent at the projection level.
5. Minimum N required. Aggregate projections that depend on cross-tenant data require a configurable minimum number of independent tenants before publication.
6. Reversibility forbidden. Once published, projections may not be updated in a way that allows reconstruction of the original tenant-identifying data.
7. Policy is itself published. This document is canonical and available in Harvest Directory’s “About” section so consumers can verify what was protected.
8. Federal audience is a separate flag, not a relaxation. Federal audience projections receive richer provenance (regulator-audience recall trace) but are NOT public; they are subject to a parallel privileged-audience policy.

2. Data Class Taxonomy

Every field in the FIN data model maps to one of these classes:

Class	Definition	Default disposition
Tenant Identity	Fields identifying the tenant (tenant_id, tenant_name, tenant_legal_name)	Strip always; replace with audience-appropriate stand-in if needed
Customer Identity	Tenant’s customer (customer_id, customer_name, customer_address, customer_contact)	Strip; aggregate only
Vendor Identity	Tenant’s vendor (vendor_id, vendor_name, vendor_address, vendor_contact)	Strip; aggregate only
Actor Identity	Individual humans (actor_id, actor_name, actor_email, actor_phone)	Strip always
Lot / Shipment / Order Identifier	Internal IDs (lot_id, order_id, shipment_id)	Strip always
Exact Financial	Exact prices, costs, margins, invoice amounts	Strip; replace with band where context demands
Banded Financial	Pricing ranges, market bands	Allowed at $0.50 / lb resolution or coarser per commodity
Operational Volume	Pallet counts, unit counts, ship counts	Aggregate to nearest 10 / 100 / 1000 by magnitude
Commodity Identity	Public commodity / variety / region designations	Preserve
Temporal Granularity	Timestamps, dates	Bucket to day / week / month per audience
Geographic Granularity	Specific addresses, GPS coordinates	Bucket to region / metro / state
Free Text	Operator notes, comms transcripts, unstructured	Strip; never publish raw
Embedded Photo / Document	Defect photos, receiving paperwork, scans	Strip identity fields; preserve commodity-illustrative content if reviewed

The detailed disposition per field is enumerated in §4-§10.

3. Projection Audiences and Their Allowed Dispositions

Audience	Policy version applied	Notes
tenant_internal	none (raw data)	Inside tenant trust boundary; full fidelity
customer_visible	tenant-customer-information-boundary	Tenant’s customers see only their own data; vendor/cost stripped
vendor_visible	tenant-vendor-information-boundary	Tenant’s vendors see their own data; customer/margin stripped
public_anonymized	THIS POLICY (v1.0.0)	Harvest Directory + Tier 0 + business intelligence subscriptions
federal_audience	federal-privileged-audience policy (separate)	Recall traces, FSMA records, agency dashboards
partner_specific	partner-specific NDA terms	Anthropic / investor / federal liaison briefings

THIS POLICY applies only to public_anonymized. Federal audience and partner-specific have their own policies (referenced but not defined here).

4. Commodity Data Disposition

For entity profiles, situation briefs, seasonal outlooks projected to public:

Field	Disposition
Commodity name (watermelon, avocado, etc.)	Preserve
Variety name (seedless mini, Hass, etc.)	Preserve
Generic origin region (Mexico, California)	Preserve
Sub-region (Sonora, Imperial Valley, etc.)	Preserve
Specific grower / farm identity	Strip unless grower has separately published / Wikipedia-equivalent listed
Specific vendor identity	Strip always
Specific customer identity	Strip always
FDA classification / regulatory data	Preserve
USDA grading reference	Preserve
Post-harvest handling specs (generic)	Preserve
Tenant-specific handling adaptations	Strip
Defect taxonomy descriptions	Preserve
Defect rate (specific tenant)	Strip
Defect rate (aggregated across tenants, ≥3)	Band to nearest 0.5%
Average price (specific tenant or trade)	Strip exact; band where context demands
Price band (aggregated, ≥3 sources)	Band to $0.50 / lb resolution
Supply volume (specific tenant)	Strip
Supply volume (aggregated, ≥3 sources)	Band to nearest 10K lb
Customer-specific shipping preferences	Strip always
Substitution recommendations (generic)	Preserve
Substitution patterns (tenant-specific)	Strip

5. Regional Intelligence Disposition

For region profiles and outlooks:

Field	Disposition
Region name (Sonora, MX; Imperial Valley, CA)	Preserve
Dominant commodities by region	Preserve
Season window (start/peak/end)	Bucket to week resolution
Aggregate volume by region	Aggregate ≥3 tenants; band ≥10K lb
Aggregate pricing by region	Aggregate ≥3 tenants; band $0.50/lb
Specific transit corridors used by single tenant	Strip
Generic transit corridor patterns	Preserve if from public sources (FRA, FMCSA) or aggregate ≥3
Specific regional disruptions tied to tenant	Strip tenant link; preserve disruption
Weather event references	Preserve (public data)

6. Operational Event Disposition

Events from tenant operations (lot received, QC fail, temperature exception) when included in aggregate intelligence:

Field	Disposition
Event type (signal.*, lot.*)	Preserve
Tenant ID	Strip
Specific lot ID	Strip
Specific arrival quantity (1 event)	Strip; aggregate count only
Temperature reading	Preserve if generic threshold context; band to ±2°F if specific
QC outcome (1 event, 1 tenant)	Strip; aggregate count only across ≥3 tenants
Commodity tied to event	Preserve
Region tied to event	Preserve at sub-region granularity
Specific vendor or customer linked	Strip
Generic vendor/customer pattern (anonymized)	Allowed (“a Mexican grower”, “a Northeast distributor”)
Timestamp	Bucket to day for weekly aggregates; week for monthly
Free-text notes from event	Strip always

7. Recall Trace Public Disposition

Recall traces in their public form (not the regulator/federal form):

Field	Disposition
Recall designation (FDA recall #)	Preserve (public record)
Affected commodity	Preserve
Generic affected region / window	Preserve
Specific lot IDs	Strip unless FDA publicly published them
Specific customer reach	Strip; aggregate count band only
Specific shipment routes	Strip
Generic recall guidance	Preserve
Tenant role in recall	Strip identity; preserve generic role description

8. Free Text and Embedded Content

Content Type	Disposition
Operator notes / annotations	Strip from public projections
Email / Teams / SMS transcripts	Strip; never publish raw or chunked to public
Voice transcripts	Strip from public projections
Defect photos with operational metadata	Strip metadata; if commodity-illustrative content is reviewed and approved, may publish; default strip
Receiving paperwork scans	Strip from public projections
Decision records (authored)	Strip from public unless explicitly marked public_safe: true in frontmatter and human-reviewed
Voice memos	Strip from public projections
External authoritative sources (USDA pubs, FDA rules, university extension)	Preserve, cite full URI

9. Anti-Re-Identification Discipline

9.1 N-of-1 Rule

For any aggregate-projected fact, the contributing source count must be ≥3 distinct tenants OR the contributing data must be from public sources only. Single-tenant projections of public_anonymized class are explicitly framed as “observations from a single Northeast distributor” or similar non-identifying framing, never as universal claims.

9.2 Combination Risk

Even after field-level stripping, combinations of fields can re-identify. The policy reviewer checks every projection for combinations that could uniquely identify a tenant given external knowledge (commodity × region × week × volume band MAY combine to identify Nathel if only Nathel ships that combination at Hunts Point).

Mitigation:

• If combination risk is detected, increase granularity buckets (week → month, sub-region → region)
• Or increase N-of-1 threshold (require ≥5 contributing tenants)
• Or omit the projection until N grows

9.3 Adversarial Probing

The public Tier 0 surface is subject to enumeration attacks (probing the API to triangulate tenant identity). Mitigations:

• Per-API-key rate limits (per MCP Surface Architecture §5)
• Anomalous query pattern detection
• No paginated enumeration of low-cardinality fields
• Honeypot tools that should never be called legitimately

9.4 Time-Lag Discipline

Real-time projections of operational data can reveal tenant timing patterns. Mitigations:

• Public projections of aggregate intelligence release no sooner than 7 days after underlying events
• Weekly summaries publish on Friday for the prior week ending Sunday (7-day lag minimum)
• Federal/regulator audience may receive real-time; public never

10. Specific Field Reference Table

Common field-to-disposition mapping for quick lookup:

Field name	Class	Public Disposition
tenant_id	Tenant Identity	Strip
tenant_name	Tenant Identity	Strip
customer_id	Customer Identity	Strip
customer_name	Customer Identity	Strip
customer_email	Actor Identity	Strip
vendor_id	Vendor Identity	Strip
vendor_name	Vendor Identity	Strip
actor_id	Actor Identity	Strip
actor_email	Actor Identity	Strip
lot_id	Lot Identifier	Strip
order_id	Order Identifier	Strip
shipment_id	Shipment Identifier	Strip
price_per_unit	Exact Financial	Band $0.50/lb
invoice_total	Exact Financial	Strip
cost_basis	Exact Financial	Strip always
margin_percent	Exact Financial	Strip always
unit_count	Operational Volume	Aggregate; band
pallet_count	Operational Volume	Aggregate; band
commodity_id	Commodity Identity	Preserve
variety_id	Commodity Identity	Preserve
region_id	Commodity Identity	Preserve
sub_region	Commodity Identity	Preserve at sub-region
arrival_temperature	Operational Data	Preserve if generic; band ±2°F
qc_outcome	Operational Data	Aggregate count
event_type	Event Metadata	Preserve
event_timestamp	Temporal	Bucket to day/week
event_payload	Free Text	Strip if includes PII
actor_notes	Free Text	Strip
comms_transcript	Free Text	Strip
defect_photo	Embedded Content	Review case-by-case
customer_address	Geographic	Strip; bucket to metro
vendor_address	Geographic	Strip; bucket to region

11. Policy Application Process

Every projection that emits to a public audience MUST:

1. Declare its source projection in the catalog with explicit audience: public_anonymized AND anonymization_policy: v1.0.0
2. Pass each field through the policy disposition lookup
3. Apply N-of-1 check for aggregate fields
4. Apply combination-risk review (manual for v1; automated review tool in v2)
5. Apply time-lag check
6. Emit doc.anonymization_applied event recording:
   • source doc/projection ID
   • policy version
   • audience
   • field disposition summary
   • N-of-1 count where applicable
   • reviewer ID (or “automated” if all checks pass deterministically)
7. Render public doc with policy version stamp in frontmatter:

   anonymization:
     policy_version: v1.0.0
     applied_at: 2026-05-15T...
     audience: public_anonymized
     n_contributing_sources: 5

12. Policy Review Workflow

Policy version updates follow the same workflow as engineering specs:

• New policy version proposed via authored doc PR
• Counsel review (legal + privacy)
• Tenant notification (tenants have right to review changes affecting their data before effective date)
• Public notice (Harvest Directory “About” page lists policy version history)
• Effective date set ≥30 days after publication
• All projections re-stamped on next regeneration after effective date
• Old policy version archived in docs/policies/anonymization/archive/

13. Tenant Opt-In

Tenants are NOT automatically enrolled in any public projection. Each tenant explicitly opts into:

• Which projections may include their data (specific entity profiles, specific aggregate intelligence)
• The minimum granularity acceptable to them
• Any commodities or regions they specifically exclude
• A revocation right (tenant may withdraw at any time; their data is removed from future projections; historical snapshots remain because they are immutable but contain no identifying detail)

Opt-in is recorded as a versioned tenant_anonymization_consent_v<version> event with full payload.

14. Tenant Visibility Into Their Contribution

Every tenant can query (via tenant MCP get_anonymization_contribution) which public projections contain data sourced from their tenant and which fields. This is the transparency mechanism.

15. Federal / Regulator Audience Policy

Federal audience projections (recall traces with audience: regulator, FSMA filings, agency dashboards) are NOT public. They are scoped to specific agencies under contract. The federal audience policy is a separate document with:

• Stricter audit retention (7 years federal-grade)
• FedRAMP-routed delivery
• Agency-specific NDA terms
• Wider field disposition (real identifiers preserved with agency attestation)

Cross-references:

• docs/policies/federal/FIN_FEDERAL_AUDIENCE_POLICY_V1.md (to be written before Wave 4)

16. Open Questions

ID	Question	Default
AP-1	Should “N≥3 contributing tenants” be a hard rule or configurable per projection?	Hard rule for v1; configurable in v2 after legal review.
AP-2	What’s the appropriate granularity bucket for pricing?	$0.50/lb default; per-commodity override allowed via projection config.
AP-3	When can defect photos be published?	Default never; case-by-case with explicit reviewer approval. v2 to formalize.
AP-4	Does retroactive policy update apply to existing snapshots?	No. Snapshots are immutable. New policy applies prospectively only.
AP-5	Federal audience policy timing?	Draft must exist before Wave 4. Counsel review required.
AP-6	Tenant SLA on opt-out propagation?	30 days from request to all-projections-purged.

17. Stop Conditions

Halt public projection emission and return to policy review if:

• A tenant identifies as re-identifiable from a published projection (incident response: pull projection, reassess granularity)
• Adversarial probing successfully triangulates tenant identity in testing
• Legal review identifies anti-trust or competition concerns from specific aggregates
• A federal audience accidentally receives non-federal-flagged data
• Policy version is in dispute (between successor and predecessor, unclear which applies); revert to predecessor and resolve

18. Effective Date and Versioning

This policy v1.0.0 is effective on the date the first public projection ships (Wave 3). Until that date, this policy is in draft status and applies to no production projections.

Version history:

Version	Effective	Notes
v1.0.0	Wave 3 ship date (target ~Q3 2026)	Initial public release

19. References

• docs/architecture/FIN_CENTRAL_TENANT_DEMARCATION_PLAN_2026-05-15.md §8
• docs/engineering/FIN_INTRANET_HUMAN_AGENT_PROJECTION_ENGINEERING_SPEC_2026-05-13.md §3.3
• docs/product/FIN_DATA_SIGNAL_OFFERINGS_2026-05-15.md §2.5, §4.4
• docs/projections/PROJECTION_CATALOG_2026-05-15.md §6.3 Plane 3 Aggregate Intelligence
• USDA AMS Market News (external authoritative source examples)
• FDA FSMA Section 204 (federal record requirements; informs federal audience policy, not this one)
• FAR 19.14 / FAR 19.15 (federal contracting clauses, contextual only)

This policy is canonical reference for every public projection. It is itself a public document — Harvest Directory’s “About” page will link to the version stamped on each rendered page.