Privacy Review

# Task 003: Privacy Review for Query Logging

> Phase 0 task. Output is a sign-off, not code.

---

## 1. Objective

Confirm with the privacy lead what's logged when `/api/users/search` is called. The PRD's open question Q1 frames the choice: log full query strings (richer analytics) vs log only filter-set hashes (privacy-preserving). The default proposal is the latter.

After this task: privacy sign-off recorded; PRD Section 17 updated; Q1 marked resolved.

## 2. Context

**PRD Reference**: [`../../prds/active/user-search.md`](../../prds/active/user-search.md) Section 17 (Security Requirements)
**Spec Reference**: [`../../specs/user-search/requirements.md`](../../specs/user-search/requirements.md) Q1; NFR-3.3
**Architecture Reference**: [`../../specs/user-search/design.md`](../../specs/user-search/design.md) Section 9 (Observability)
**Phase Master**: [`000_MASTER_foundation.md`](000_MASTER_foundation.md)
**Global Master**: [`../000_GLOBAL_MASTER.md`](../000_GLOBAL_MASTER.md)

The proposal: every search emits a structured log entry with `request_id`, `actor_id`, `filter_set_hash`, `result_count`, `duration_ms`, `cache_hit`. The hash is deterministic so analytics can group by query pattern, but the original strings (which may contain partial emails) are not preserved.

The privacy lead may raise:

- Whether `actor_id` paired with `filter_set_hash` constitutes PII linkage.
- Whether log retention windows are tight enough.
- Whether structured log access is auditable.

## 3. Agent Assignment

**Primary Agent**: `security-auditor` (see [`../../agent-roster.md`](../../agent-roster.md))
**Supporting Agents**:

- Privacy lead (human reviewer, not an agent).

## 4. Prerequisites

- [ ] Privacy lead identified and engaged.
- [ ] Existing log retention and access controls documented.
- [ ] PRD Section 17 has the proposed logging design.

## 5. Task Details

### 5.1 Goal

Get the privacy review signed off. The output is a one-page review summary attached to the PRD.

### 5.2 Process

1. Schedule the privacy review with the privacy lead.
2. Brief them: read PRD Section 17, design Section 9.
3. Walk the proposed log shape, including a sample log line.
4. Discuss alternatives (no logging at all; full string logging with consent banner).
5. Capture the decision.
6. Update PRD Section 17 with the final logging shape, retention window, and any constraints.

### 5.3 Sample log line for review