Small, honest telemetry.

AccessGraph is an early pilot. It stores a request ID, time, target origin, a hash of the target and action, decision, client cohort, pseudonymous client key, receipt hash, transport, processing time, cache status, evidence age, a fixed-category self-declared source, and an optional client-reported outcome. It does not sell raw browsing histories or client identities.

What is sent and stored

The target URL is processed in memory and sent to the publisher to inspect access signals. Do not submit confidential URLs, signed links, or credentials. The database does not retain full URLs, query strings, fetched bodies, raw IPs, bearer tokens, or feedback tokens. A rotating daily hash of the connecting IP supports quotas and anonymous deduplication; hashing is pseudonymization, not guaranteed anonymity. Target hashes can also be guessable.

Short-lived cache

Eligible query-free route advice may remain in worker memory for at most five minutes, bounded to 128 entries per worker. The cache holds evidence and route URLs, never fetched page bodies, and is scoped to the pseudonymous client and cohort. Cache hits retain original observation timestamps. Publisher no-store/private directives and shorter freshness limits are respected.

Retention

Application event rows expire after 30 days and quota rows after one day. Expired records are purged during subsequent API activity. An inactive deployment requires an operator purge; deletion is not a continuous background process. Hosting providers may separately process operational request logs under their own policies.

No manufactured adoption

Website inspections are labelled demo. Calls without provisioned credentials are external_unverified; they may be humans, scanners, tests, or bots. external_registered identifies an operator-provisioned external integration, not proof of agent autonomy. Client-reported success stays distinct from service observations.

Public output

The Access Index exposes aggregate decisions and cohort counts, not origins, client IDs, or individual requests. The pilot does not provide a signup database or collect email addresses. Before commercial launch, the operator must publish a contact address and processes for access/deletion requests.