Add an enforced security policy with auditable scope and rule payload.

Preserve high-risk records with explicit review reason and hold scope.

Publish explicit masking coverage for sensitive data surfaces.

Gate risky exports with explicit domain restriction and condition evidence.

Set retention and purge posture for auditable security operations.