Identity data: an admin reading a KYC record or a partner profile is audit-logged, as opening the ID document already is (D612)

[guillaumelauzier]

S1: Reading a member's KYC record is not logged, though opening their ID document is. Decision D612. No migration. Found by #1165's audit (area 7, kycAdminGet and adminGetProfile).

What is true on main

• Opening the ID document is logged. GET /api/kyc/admin/:userId/document writes kyc_document_access to activity_logs on every view (cloudflare-worker/src/routes/kyc.ts), with the actor hashed.
• Reading the record is not. GET /api/kyc/admin/:userId returns the record and logs nothing. The record holds legal name, date of birth, nationality, address, ID type and number, and phone.
• The queue. The admin KYC queue (/admin?tab=kyc) reads rows that already carry the same kyc_data. Check whether that read is logged.
• Partner profiles. GET /api/profiling/admin/:email (routes/profiling.ts) returns a partner profile's EIN and onboarding transcript, unlogged.

The work

1. Log each read of identity data the way kyc_document_access is logged: the actor hashed with hashEmail, the member's id, and no field values. The actions:
   • kyc_record_access, for the record;
   • kyc_queue_access, for a queue read: one row per read, with the count, not one per member;
   • partner_profile_access, for the profile read.
2. Trim the queue. If the queue's rows carry full kyc_data only to fill the review window, return them without the identity fields, and let the window read the record (now logged). Say in D612 which you did and why.
3. D612 records what is logged, that values never reach the log, and the queue change.

Files this task owns

• cloudflare-worker/src/routes/kyc.ts
• cloudflare-worker/src/routes/profiling.ts (the admin read only)
• the KYC review window in frontend/src/pages/AdminPage.jsx, only if step 2 changes what it reads
• new tests
• documentation/architecture/decisions/D612.md

Do not build masking in the review windows. Its design is requested on #1165 (area 7, item 6).

Done when

• Tests cover:
  • each read writes one log row, with the actor hashed and no identity value in details;
  • a 404 logs nothing;
  • the queue's shape after step 2.
• Every new assertion is mutation-checked.

---

Generated by Claude Code

[guillaumelauzier]

S1: Moved from S13 to S16, the owner's call (2026-10-06). S13: do not start it; it is S16's now.

• Where it stands. It was state:ready: no STATUS, no branch and no PR, so S16 starts from the latest main.
• The spec, its decision number and any migration number stand as written above.
• S16's queue, oldest first, one at a time: Colleague seats: the invite reaches the colleague, and accepting never turns an admin into an investor (D611) #1311, Identity data: an admin reading a KYC record or a partner profile is audit-logged, as opening the ID document already is (D612) #1312, Contract document types: saving a draft for a published type no longer changes the live type; publishing does (D615, migration 416) #1313, Article review comments: only the author or a Super Admin deletes one, and the delete is logged (D617) #1314, Decision journal: record when a thesis is edited after its outcome (D618, migration 415) #1315, Remove five dead client methods: one has no Worker route, one always fails, three repeat a method in use (D616) #1316.

---

Generated by Claude Code