Pillar — Data

Prefix: DAT- Catalog: v1.1 (new pillar). What it measures: whether an agent can reason about state safely — published data contracts, classification, retention, and access paths that say which records it may touch and how long they live.

Running a business is mostly data in motion. Without those contracts, an agent either guesses at schema or copies production state into the wrong place. There is no v1.0 DAT catalog; IDs in the DAT-1xx band are the first published criteria for this dimension.

Criteria in this pillar

DAT-100 — Published data contract per store

Level: 2 · Scope: application · Check: deterministic
Each application publishes a machine-readable contract for every store it owns. The contract names the schema (or equivalent shape), an owner, a default classification, and the write path. A wiki paragraph or an inferred ORM model is not a contract.
Rationale: an agent that cannot read the shape of state will invent a column, copy a dump, or write through an undocumented client. A queryable artifact is the only form a pipeline or an unattended operator can honour.
Evidence expected: a committed schema, contract file, or equivalent structured record per store; fields include owner, default classification, and write path; a documented query path returns the current contract.

DAT-110 — Classification is field- or record-level

Level: 3 · Scope: portfolio · Check: deterministic
Classification labels (public, internal, restricted, or an equivalent published set) are applied at field or record granularity. Applications that share a type use the same labels. A single banner that the whole store is confidential does not satisfy this criterion.
Rationale: portfolio scoring is the unit. A blended "this database is sensitive" label hides the column an agent is about to log, export, or join. Shared types that mean different things in each application are how restricted data leaks into a sibling slice.
Evidence expected: a committed classification vocabulary; field- or record-level labels on in-scope stores; a mapping that the same logical type carries the same label across applications, or an owned exception.

DAT-120 — Retention and deletion are executable

Level: 3 · Scope: application · Check: deterministic
Each classified store names a retention period and a deletion or anonymization path that can be run without a human writing a one-off query. Expired records have a scheduled job or a documented command. A policy sentence with no runner does not satisfy this criterion.
Rationale: agents keep copies. A retention rule that exists only in a handbook will not stop a replay, a backup restore, or a debug export from living forever. The path has to be something the runtime can invoke.
Evidence expected: retention period on the DAT-100 contract or an equivalent record; a job, workflow, or command that deletes or anonymises expired rows; a recent run or a dry-run log for at least one classified store.

DAT-130 — Agent access paths are named and default-deny

Level: 4 · Scope: application · Check: deterministic
Read and write paths an agent may use are enumerated (identity, store, allowed operations). Paths not listed are denied by default. Copying production state into local disk, chat context, or an unclassified store is forbidden on the published path list.
Rationale: a contract without an access path still leaves the agent a live credential and a hope. Default-allow is how an unattended operator dumps a production table into the wrong place. Naming the path is what an assessor — and the next agent — can enforce.
Evidence expected: a committed path list or policy binding identity to store and operations; a control that denies unlisted paths; a documented prohibition on production dumps into local or chat context.

DAT-140 — Portfolio store inventory published as k/n

Level: 4 · Scope: portfolio · Check: manual
Stores versus published contracts are visible per application as k/n applications with every owned store contracted. A blended inventory that hides an undocumented sibling store does not satisfy this criterion. A newly added application is on the inventory within one review cadence or is marked not_applicable with a one-line justification.
Rationale: one well-contracted application next to a shadow store is not an agent-ready product. Portfolio scope (CSPC-31) is the scoring unit.
Evidence expected: inventory or report with per-application store list, contract coverage, and k/n; cadence stated; not_applicable entries justified.

v1.1 pillars — draft catalog, including these DAT-1xx criteria.
v1.0 Security & Access Control — supply-chain and access hygiene; DAT names which records those controls protect.
v1.0 specification — the published standard.

Criteria in this pillar

Level: 2 · Scope: application · Check: deterministic

Each application publishes a machine-readable contract for every store it owns. The contract names the schema (or equivalent shape), an owner, a default classification, and the write path. A wiki paragraph or an inferred ORM model is not a contract.

Rationale: an agent that cannot read the shape of state will invent a column, copy a dump, or write through an undocumented client. A queryable artifact is the only form a pipeline or an unattended operator can honour.

Evidence expected: a committed schema, contract file, or equivalent structured record per store; fields include owner, default classification, and write path; a documented query path returns the current contract.

Level: 3 · Scope: portfolio · Check: deterministic

Classification labels (public, internal, restricted, or an equivalent published set) are applied at field or record granularity. Applications that share a type use the same labels. A single banner that the whole store is confidential does not satisfy this criterion.

Rationale: portfolio scoring is the unit. A blended "this database is sensitive" label hides the column an agent is about to log, export, or join. Shared types that mean different things in each application are how restricted data leaks into a sibling slice.

Evidence expected: a committed classification vocabulary; field- or record-level labels on in-scope stores; a mapping that the same logical type carries the same label across applications, or an owned exception.

Level: 3 · Scope: application · Check: deterministic

Each classified store names a retention period and a deletion or anonymization path that can be run without a human writing a one-off query. Expired records have a scheduled job or a documented command. A policy sentence with no runner does not satisfy this criterion.

Rationale: agents keep copies. A retention rule that exists only in a handbook will not stop a replay, a backup restore, or a debug export from living forever. The path has to be something the runtime can invoke.

Evidence expected: retention period on the DAT-100 contract or an equivalent record; a job, workflow, or command that deletes or anonymises expired rows; a recent run or a dry-run log for at least one classified store.

Level: 4 · Scope: application · Check: deterministic

Read and write paths an agent may use are enumerated (identity, store, allowed operations). Paths not listed are denied by default. Copying production state into local disk, chat context, or an unclassified store is forbidden on the published path list.

Rationale: a contract without an access path still leaves the agent a live credential and a hope. Default-allow is how an unattended operator dumps a production table into the wrong place. Naming the path is what an assessor — and the next agent — can enforce.

Evidence expected: a committed path list or policy binding identity to store and operations; a control that denies unlisted paths; a documented prohibition on production dumps into local or chat context.

Level: 4 · Scope: portfolio · Check: manual

Stores versus published contracts are visible per application as k/n applications with every owned store contracted. A blended inventory that hides an undocumented sibling store does not satisfy this criterion. A newly added application is on the inventory within one review cadence or is marked not_applicable with a one-line justification.

Rationale: one well-contracted application next to a shadow store is not an agent-ready product. Portfolio scope (CSPC-31) is the scoring unit.

Evidence expected: inventory or report with per-application store list, contract coverage, and k/n; cadence stated; not_applicable entries justified.