Monitoring Policies

SL-10

Configurable at instance, schema, table, column, user and application level, with logging fidelity set by sensitivity. Full capture on personal-data tables and standard elsewhere keeps the audit trail useful without drowning the storage budget.

DischargesS.8(4)R.6 S.9

1 policies have break-glass access active

Break-glass exceptions carry a hard expiry and a full audit trail. They exist because emergencies happen; they expire automatically because temporary exceptions that never expire are how least privilege quietly dies.

Policies

Enabled

Full-fidelity logging

On personal-data objects

Interventions (30 days)

Configured policies

Mass read on citizen identifier tablestable scopeFull capture

citizen.beneficiary, citizen.household

Applies to specific tables only.

30-day hits

Thresholds

rows_returned > 10,000

Also baseline-driven

Action on match

terminate session

S.8(4)R.6

Any access to children's data columnscolumn scopeFull capture

welfare.enrolment.student_name, student_dob, guardian_contact

The tightest scope — individual columns, used for special-category data.

30-day hits

Thresholds

rows_returned > 100

Action on match

alert

Break-glass expires in 3 days

S.9 R.10

Privilege change on classified objectsinstance scopeFull capture

All production instances

Applies to every object on the instance.

30-day hits

Thresholds

ddl_dcl_events > 0

Action on match

alert

R.6

Service account outside its windowuser scopeStandard

svc_* accounts

Follows the identity rather than the object.

30-day hits

Thresholds

off_window_sessions > 0

Also baseline-driven

Action on match

block user

S.8(4)R.6

Export to file from any classified tableschema scopeFull capture

citizen.*, health.*, welfare.*

Applies to all objects within the named schemas.

30-day hits

Thresholds

export_statements > 0

Action on match

quarantine

S.8(4)R.6

Attempt to disable auditinginstance scopeFull capture

All instances

Applies to every object on the instance.

30-day hits

Thresholds

audit_config_changes > 0

Action on match

alert

R.6 S.28

Why column-level scope matters

A policy scoped to the whole instance produces alerts nobody reads. A policy scoped to three columns holding children's dates of birth produces alerts people act on within the hour. The Rules do not prescribe policy granularity, but the difference between monitoring that works and monitoring that exists on paper is almost entirely here.