Skip to content

Forms Portal — Field Audit

Classification: CONFIDENTIAL — Internal Use Only
Document: governance/forms-field-audit.md · v1.2 · 2026-08-10 · GPUS-IT
GENERATED — do not hand-edit. Regenerate with governance/scripts/gen_audit_doc.py (see §2).


1. Purpose — this is a repeatable control, not a snapshot

This audit answers one question for every field on every live form: who actually receives this answer?

It reads the live production database, not this repository. That distinction is the point of the control — the routing worker dispatches from the actions table, so a change committed here but not reloaded is not in force. Auditing the repo would report intent; auditing the database reports reality.

Re-run it whenever forms or templates change, when an owner changes, and at minimum quarterly. Each run supersedes the last; findings carrying a decision are retained below so a re-run never silently re-opens a settled question.

Why the template is the access boundary

One submission does not go to one place. It fans out to several destinations, and each destination renders its own template against the same field values. A template that does not reference {{ Field }} does not show that field to that queue. So the per-queue template is the access control, and "who sees this field" can only be answered by parsing the placeholders out of every template a form dispatches. See gpus-forms-routing-worker/template_render.py.

2. How to re-run

cd governance/scripts
./fetch_live.sh                 # VPN + SSH to MAPLE -> live snapshot in ./_live
python3 build_audit.py          # -> audit.json
python3 gen_audit_doc.py        # -> this document
python3 gen_owner_reviews.py    # -> governance/reviews/*.docx

Requires: VPN to 172.16.0.12, SSH as cloudadmin, cloud-sql-proxy live on MAPLE, and python3 -m pip install pyyaml python-docx jinja2. The database is read as maple-agent@gpus-infra.iam, which already holds the necessary grants (migration 013) — no break-glass grant and no impersonation is required. Queue names come from the HappyFox categories API and are pinned in build_audit.py.

jinja2 is required because build_audit.py resolves a template's field references by parsing it with the same engine the dispatcher renders with (jinja2.meta.find_undeclared_variables), not by scraping {{ Field }} placeholders. A template can reference a field without printing it bare — conditionally, inside {% if %} — and a regex misses exactly those. See §5.5.

A deploy is a reload

forms-backend/app.py runs load_all() on every container boot unless FORMS_SKIP_YAML_BOOT=1 is set. Any push that redeploys the backend therefore applies forms/*.yaml to the live actions table immediately — there is no separate approval step, and POST /api/admin/reload is only needed to re-apply without a deploy. Treat a merge to main as a production routing change.

3. Scope of this run

Measure Count
Live forms 28
Fields collected 320
Routing rules (actions) 66
Delivery templates 48
Distinct delivery copies produced 52
Read from live production database (gpus_forms)
Read on 2026-08-10

Forms by owning category: Facilities (1), Finance & Accounting (1), Human Resources (11), Information Technology (4), Other (9), Supporter Care (2).

4. Destination reference

Routing destinations are stored as numeric HappyFox category ids with no mapping anywhere in the codebase. These were confirmed against the HappyFox categories API on 2026-08-03 and are pinned in build_audit.py. Do not infer them from co-routed email addresses — that method cannot resolve #85 or #71.

The same rule applies to role email addresses, which are resolved from EMAIL_OWNERS in build_audit.py. An address missing from that map falls through to the individual bucket, where it reads as a personal mailbox and — because the per-owner review copies are scoped by delivery — drops its form out of that owner's review entirely. gpus-it-infrastructure@greenpeace.org was missing until 2026-08-04, which is why Frontline Form Request was absent from the IT review copy issued on 2026-08-03.

Queue id HappyFox category Owning function
45 US - IT Support IT Support
71 US - IT Infrastructure IT
81 US - IT Accounts IT Accounts
85 US - Data Requests Data Team
92 US - People HR
96 US - Finance Support Finance
100 US - Facilities Facilities

5. Findings

The headline result: no cross-department leak. Compensation, grant funding, benefits, employment terms and EEO data render only in copies addressed to HR. The IT, Finance, Facilities and Data team copies of every form carry none of it. Verified against every template of every form.

5.1 Personal mailboxes were routing destinations

CLOSED

Three individual addresses received copies across 17 delivery legs on 10 forms. Four of those legs carried compensation, salary band, pay scale and EEO1 data alongside the HR team address. A personal mailbox does not transfer when someone changes role and is not revoked when they leave.

Disposition: CONFIRMED — decision taken by the Director of IT. All three addresses removed from every routing destination in commit 3015628, and live in production since 2026-08-03 16:51 UTC. No manual reload was needed: forms-backend/app.py calls load_all() on every boot unless FORMS_SKIP_YAML_BOOT=1, so the Cloud Run deploy of revision gpus-forms-backend-00070-nxq re-loaded the YAML into the actions table automatically. Verified against the live database: all 17 legs carry no personal address and each retains its team address; zero orphaned legs. No submission was received between deploy and verification (the most recent submission predates it by five days), so no notification was missed.

5.2 The Data Requests queue receives full employee records

APPROVED ROUTING

HappyFox queue #85US - Data Requests — receives a copy of both Employee Termination and New Employee, including home address, contact phone and cost centre. No compensation, benefits, grant or EEO field reaches it.

Disposition: CONFIRMED INTENTIONAL by the data owner. This is documented and approved routing supporting database account provisioning and deprovisioning, not an exposure. Recorded here so the next audit does not re-raise it. Re-confirm if the queue's membership or purpose changes.

5.3 Five forms deliver to an empty address

CLOSED

Research Request, Data Restoration Request, Project Planning Facilitation Request, Video Licensing Request and Photo Licensing Request each carried an email_template action whose destination was an empty string. Submissions were stored and reached nobody. All five were live and accepting submissions. Verified against the live database 2026-08-04: all five had zero submissions, so the exposure was prospective — nothing was actually lost.

Disposition: RESOLVED 2026-08-04, two ways. Routed: Data Restoration Request now delivers to gpus-it-support@greenpeace.org — IT-owned, and its Fileserver options are the on-prem WDC shares (canopy/grass/water.wdc.us.gl3), so the destination was unambiguous. Deactivated: the other four were set is_active: false rather than routed to a guessed address. None of them maps to any of the seven role mailboxes the portal actually uses, so every candidate destination would have been invented. Zero submissions in 105 days suggests abandoned rather than mis-routed, and the two licensing forms collect third-party external contact data (name, phone, email, publication, circulation) into a seven-year retention bucket nobody reads — deactivation stops that collection now and is fully reversible. Each of the four needs an owner nomination before reactivation. Research Request is the sharpest case: its Researcher pulldown names four individuals, so the only available signal points at a personal mailbox — the precise anti-pattern closed in commit 3015628. A role address must exist first.

5.4 Data Request Form collects 68 fields and routes nowhere

CLOSED

The largest form in the portal had no delivery action at all. Its single action was dropped during the 2026 migration as a foreign-key violation (template_id 'X' did not exist) and never replaced — the legacy row was a scaffold stub with neither a valid template nor a destination, so there was no working configuration to restore.

Disposition: RESOLVED 2026-08-05. The form is a donor list-pull request — it collects selection criteria (account types, exclusion sets, output format), not donor records, and carries no third-party personal data. It now routes to gpus-data-request@greenpeace.org via a purpose-built Data Request Form Template (d04a46e12a695a9c), authored for this fix because none existed. Rendering: 56 of the 68 fields are checkboxes, and an unticked checkbox is absent from the payload, so a naive all-placeholder template would print ~50 [Key: —] undefined-markers on every ticket. The template therefore lists only ticked options, grouped by the form's own section dividers, with (none selected) otherwise. The test is == 'True', not truthiness: checkbox values are stored as the strings "True" and "False", and "False" is non-empty, so a truthiness test would report a ticked-then-unticked box as selected. Field-key fix: five keys (1R, 2SOL, 3SOL, 1SOL, 1SOLSP) began with a digit and were therefore unreferenceable in any Jinja template — a TemplateSyntaxError raised at parse time, which the safe-undefined machinery cannot catch, so any template naming them would hard-fail every send. They were renamed to R1, SOL2, SOL3, SOL1, SOL1SP, following the precedent set by the migration's own renames on this form (CFCCFC_2, Customized OutpuCustomizedOutpu). All 67 renderable fields are now referenced; Attachment is deliberately excluded, since attachment fields never enter the field dict and would render a permanent marker — the template says so in prose instead. The seven pre-fix submissions are not routed retroactively. All seven were submitted by one account between 2026-05-08 and 2026-06-12, before the portal entered real use on 2026-07-28. Their decrypted Summary values are Test Test, test1, test2, test, Phase 2.5(b) test 2026-05-08, test, test — pre-production test data, verified under audit (decrypt_success ×7, 2026-08-04 17:06 UTC). None is a data-subject, deletion or privacy request; there is no response-time obligation and nothing to recover. Forwarding them would have put seven tickets reading "test" into the Data Team queue.

5.5 14 fields are collected but rendered by no copy

⚠️ OPEN

New Employee (11) and Rate/Position Change (3) collect fields that appear in no template, so no team receives them. They are still encrypted and retained for seven years. Three further fields report as no-copy and are excluded by design: the Attachment field on DHCP Request, IT Support Request and Data Request Form. Attachment fields never enter the renderer's field dict — the worker appends signed GCS links as a footer instead (routing_worker.py:472-476) — so referencing one in a template would print a permanent [Attachment: —] marker. Not a gap.

Disposition: Open — awaiting the HR owner review. Either route them or remove them from the form. Count corrected 2026-08-10, twice over. It was 15 (New Employee 11 + Rate/Position 4); Rate/Position dropped to 3 when LaptopRequired, LaptopType and CostCenter were routed in commit 89ebf11 (§5.8), which this page had not yet picked up. A generator defect briefly inflated it to 77. build_audit.py extracted a template's field references by scraping bare {{ Field }} placeholders. The Data Request Form template authored for §5.4 tests 56 checkboxes inside {% if X == 'True' %} blocks and prints only the ticked labels, so the regex saw 8 of its 69 keys and reported the other 61 as reaching nobody — on the largest form in the portal, and exactly backwards, since those fields are delivered. Fixed by parsing with Jinja itself (jinja2.meta.find_undeclared_variables), the same library the dispatcher renders with, so the audit now answers what the real renderer references rather than what a regex can spot. {% set %} locals are correctly excluded and Jinja's own globals are filtered. The cross-department leak check was re-run under the stricter parser and still reports zero — no HR-scoped field turned out to be referenced inside a conditional in a non-HR template, which is the failure the old parser could not have detected.

5.6 Duplicate notices from a single submission

⚠️ OPEN

Finance receives two differing copies of Employee Termination (Facilities and IT Termination templates). IT Accounts receives two differing copies of New Employee (General and IT New Employee templates).

Disposition: Open — awaiting the Finance and IT owner reviews to choose which copy survives. This is an owner decision about what Finance should see, not a delivery bug — Finance is receiving a copy today, and the question is only which scope is right. Finance's current copy is the Facilities-scoped template (b1a51710e91b8b18), which omits Referend, ShippingLabel, Address, CityState and Phone; the IT-scoped copy (1bc942e2c1589ec7) carries them. Do not resolve this by adding a leg. §5.13 records that the deferred HappyFox leg to queue 96 would, if given an email twin, manufacture exactly the second Finance copy this finding exists to eliminate. Reviewed and explicitly declined 2026-08-10.

5.7 One termination copy renders a broken placeholder

CLOSED

The Facilities copy of Employee Termination (b1a51710e91b8b18) contained the legacy tag <% = Note =>, which printed literally instead of rendering the note. Facilities and Finance saw it on every termination notice — Finance because it is bundled onto the Facilities destination line at action order 4, so it inherits the Facilities-scoped copy (see §5.6).

Disposition: RESOLVED 2026-08-10. Corrected to {{ Note }} in forms/templates.yaml. Verified through the real dispatch renderer (gpus-forms-routing-worker/template_render.py) against the live template body pulled from production, not the repo copy: the note renders its value when present; a blank note leaves the label with an empty value and introduces no marker; an absent note degrades to the standard estate-wide [Note: —] idiom and no new marker class. Only the Note line changed — every other byte of the template is identical, and the HR (b92e6aaaf7247e4d) and IT (1bc942e2c1589ec7) termination templates are byte-unchanged. Estate-wide legacy-tag sweep, live DB 2026-08-10: of 48 templates, exactly one contained <% and exactly one contained => — both this template. Zero classic <% … %> ERB, zero ${…}. The estate is clean; this was the last one.

5.8 Laptop questions never reach IT

CLOSED

On Rate/Position Change, LaptopRequired was rendered by no copy and LaptopType appeared only in the HR copy. IT Accounts, who issue the hardware, received neither.

Disposition: CLOSED. {{ LaptopRequired }}, {{ LaptopType }} and {{ CostCenter }} added to the IT Position Change Template in commit 89ebf11, confirmed by the Director of IT. Verified live 2026-08-04: both placeholders are present in the production template body, so LaptopRequired now reaches IT Accounts and Finance, and LaptopType reaches IT Accounts, Finance and HR. No sensitive boundary was crossed — the laptop fields are unclassified and CostCenter is COST. Two related gaps remain open and are carried in the IT review, not here: the only laptop field on an IT-owned form — Laptop/Projector Request on IT Support Request — is still rendered by no copy; and on New Employee, LaptopType sits only in the IT New Employee Template, which is one of the two duplicate IT Accounts copies in §5.6, so retiring the wrong copy would silently lose it.

5.9 Six field labels contain authored HTML

⚠️ OPEN

Labels on Data Restoration Request, Office Visitors Notification, and the Video and Photo Licensing forms embed <i>, <b> and <br/>. Correct in the web form; renders as literal markup anywhere else.

Disposition: Open. Cosmetic. This generator flattens them for reporting; the underlying labels are unchanged.

5.10 Employee Termination's five deferred HappyFox legs are covered, not lost

NOT A DEFECT

Employee Termination carries 8 actions: 3 email_template and 5 happyfox_template. routing_worker.py:680-694 marks every HappyFox action deferred, records success=true and continues (VLN-011), so only 3 of 8 legs dispatch. Read as an action count that looks like an 80%-loss form. It is not. Every one of the five deferred queues' owning teams already receives an email copy on the same submission, and four of the five receive the byte-identical template:

Deferred queue Owning team Email twin Template
81 IT Accounts IT Accounts order 7 → gpus-it-accounts@ same (1bc942e2c1589ec7)
85 Data Requests Data Team order 7 → gpus-data-request@ same (1bc942e2c1589ec7)
92 HR / People HR order 0 → gpus-people@ same (b92e6aaaf7247e4d)
100 Facilities Facilities order 4 → gpus-facilities@ same (b1a51710e91b8b18)
96 Finance Finance order 4 → gpus-finance-support@ differs — see §5.6

Disposition: NOT A DELIVERY GAP — determined 2026-08-10 against the live database. Evidence: 6 submissions all-time, 30 deferred HappyFox legs across them (5 × 6), and zero missed team notifications. Every deferred leg had an email twin to the same owning team on the same submission. The one real historical loss is unrelated and already fixed: the two form_version = 2 submissions (2026-07-14) carried a ninth action, an email_template that failed empty_destination — a remnant of the personal-mailbox era removed by commit 3015628 (§5.1). It no longer exists in the live action set. Also noted: the first four of the six submissions were rerouted wholesale to a single override inbox (FORMS_ROUTING_RECIPIENT_OVERRIDE, the G4.4 drill); the override was off by 2026-07-23 14:26, so only the last two delivered to real team mailboxes. No action taken and none required. Adding email twins for the five deferred legs — the fix pattern that was correct for it-support-request — would ship four byte-identical duplicate emails per termination and manufacture the second Finance copy of §5.6. The patterns are not interchangeable: it-support-request was 0 of 1 owning teams notified; this form is 5 of 5.

5.11 2.5(e) deconfliction points in OPPOSITE directions on the two affected forms

⚠️ OPEN

Both it-support-request and employee-termination-notification now carry HappyFox legs and email legs to the same owning queues. When 2.5(e) lands API dispatch, both will double-deliver — but the leg that must be removed is not the same one on each form, and there is no single rule that covers both:

Form Legs On 2.5(e), remove Why
it-support-request 1 HF (45) + 1 email (gpus-it-support@) the email leg the email leg was added to restore delivery; the HF leg is the intended permanent path
employee-termination-notification 5 HF + 3 email the five HF legs the email legs already deliver to all five owning teams and predate the HF legs in effect; the HF legs are the duplicate

Disposition: OPEN — precondition for 2.5(e), and both rows must appear in the same deconfliction list. Recorded 2026-08-10. The failure mode if only one direction is remembered: it-support-request gets deconflicted (it is the form the VLN-011 work touched and the one carrying the in-YAML TODO), Employee Termination does not, and every termination opens five duplicate tickets across five team queues on the day 2.5(e) ships. Tracked against the T3 2.5(e) PRECONDITION — HappyFox ingest/API deconfliction item. Note the asymmetry is why a per-form review is required rather than a global "drop the email legs" or "drop the HF legs" sweep.

5.12 Email-ingest capability is proven for two addresses of eight

📌 STANDING CONSTRAINT

EMAIL_OWNERS in build_audit.py maps a role address to the function that owns it. It does not — and was never intended to — assert that the address is a HappyFox email-ingest endpoint that opens a ticket in that queue. Those are different properties, and only one address in the portal has the second one demonstrated:

Address Ingest proven? Evidence
gpus-it-support@greenpeace.org yes #USITS00357259 (2026-06-12, G4.4), #USITS00365024 and #USITS00365073 (2026-08-06, VLN-011) — all auto-opened with no HappyFox action dispatched
gpus-people@, gpus-it-accounts@, gpus-facilities@, gpus-finance-support@, gpus-data-request@, gpus-it-infrastructure@ no never tested
gpus-admin-ops@greenpeace.org yes — proven 2026-09-01 Token test ADMINOPS-INGEST-20260901-165305, sent 16:53:05 UTC from MAPLE through the real Postfix + SASL relay (Postfix queue id 75D693157143, relay=smtp.gmail.com:587, status=sent 250 OK), opened #U-AO00368986 in US - Admin Ops — the exact label pinned for category 299. Requestor recorded as alerts@greenpeace.us, the documented SASL rewrite, confirming the message took the portal's own path. Queue confirmed two ways: label identity, and the U-AO ticket prefix against USITS on every previously observed portal ticket

Disposition: STANDING CONSTRAINT — not a task, and nothing to close. Recorded 2026-08-10. Any future fix of the form "this queue defers, so add an email leg to the owning team's address" rests on an untested assumption. The failure is silent and indistinguishable from success: a role mailbox that is not ingest-wired accepts the mail, opens no ticket, and returns the same 250 OK as one that works. The submission row reads routed, the audit row reads success=true, and nothing anywhere records that no ticket exists. This is the same spine as VLN-010 and VLN-011 — absence of an error is not evidence of delivery. Before relying on any of the six still-unproven addresses, send one test and confirm a ticket number — AND confirm the ticket landed in the INTENDED queue. A ticket opened in the wrong queue is a different failure and is indistinguishable from success on the mail side. Adding a queue id to HAPPYFOX_QUEUES proves the queue exists and nothing more; see 299, added 2026-09-01. Note this constraint did not bind the Employee Termination decision (§5.10), because that determination added no leg and depends on no ingest assumption.

5.13 Queue #85 resolves only by a dept-code join; the pinned maps disagree on its label

⚠️ OPEN

Deriving an owning address from a queue id means joining HAPPYFOX_QUEUES to EMAIL_OWNERS in build_audit.py. Six of the seven queues join on an exact label + dept match. #85 does not: the queue map labels it "Data Requests" while the address map labels gpus-data-request@greenpeace.org as "Data Team". It resolves only because the dept code DATA happens to be unique across EMAIL_OWNERS.

Disposition: OPEN — harmless today, ambiguous on the day it is not. Recorded 2026-08-10. A single-key join that works by uniqueness rather than by matching is correct until a second DATA address is added, at which point the derivation silently becomes a coin flip. #85 is already the queue the governance record singles out as unresolvable by inference (§4). Either align the two labels or make the queue→address relation explicit rather than derived. Not changed here: it is a generator-hygiene fix with no live routing effect, and this pass deliberately changed no routing.

6. Per-form detail

For each form: the copies it produces, then every field with the teams that receive it. in Receives means the field is collected and stored but rendered by no copy.

Information Technology

DHCP Request

dhcp-request · 7 fields · 1 copies · retained 7 years

Receives a copy Channel Template
IT Support Email DHCP Request Template
Field Key Type Required Sensitivity Receives
DHCP Entry Type DHCPEntryType Dropdown Yes IT Support
Wireless MAC Address WifiMACAddress MAC address IT Support
Wired MAC Address MACAddress MAC address IT Support
For which user (Greenpeace e-mail username) User Text Yes IT Support
Remove old entry from KACE? RemoveFromKace Dropdown Yes IT Support
Notes Notes Long text IT Support
Attachment Attachment File upload

Data Restoration Request

data-restoration-request · 5 fields · 1 copies · retained 7 years

Receives a copy Channel Template
IT Support Email Data Restoration Request Template
Field Key Type Required Sensitivity Receives
Fileserver Fileserver Dropdown Yes IT Support
Share Name (i.e. Everyone or P:) Share Text Yes IT Support
Location (i.e. /xd/accounts/2009/July/inc.xls) Pathname Text Yes IT Support
Deadline (if any) Deadline Text IT Support
Comments/Requests Comments Long text IT Support

Dynamic DNS Hostname Notification

dynamic-dns-hostname-notification · 2 fields · 1 copies · retained 7 years

Receives a copy Channel Template
IT Support Email DynDNS Hostname Notification Template
Field Key Type Required Sensitivity Receives
DynDNS Hostname Hostname Text Yes IT Support
Requested Action RequestedAction Dropdown Yes IT Support

IT Support Request

it-support-request · 5 fields · 2 copies · retained 7 years

Receives a copy Channel Template
IT Support HappyFox ticket queue IT Support Request Template
IT Support Email IT Support Request Email Template
Field Key Type Required Sensitivity Receives
Issue Subject Text Yes IT Support
Description Description Long text Yes IT Support
Error Message (if any) Errors Long text IT Support
Date when the issue was first seen RequestedDates Date Yes IT Support
Attachment Attachment File upload

Supporter Care

Frontline Form Request

frontline-form-request · 3 fields · 1 copies · retained 7 years

Receives a copy Channel Template
IT Infrastructure Email Frontline Form Request
Field Key Type Required Sensitivity Receives
Location Location Dropdown IT Infrastructure
Range of Dates to Pull StartDate Date IT Infrastructure
Until EndDate Date IT Infrastructure

Refund Processing Form

refund-processing-form · 11 fields · 1 copies · retained 7 years

Receives a copy Channel Template
Finance Email Supporter Care Refund Request
Field Key Type Required Sensitivity Receives
Today's Date Date Date Finance
Contributor Number ContributorNumbe Text Yes Finance
First Name FirstName Text Yes Finance
Last Name LastName Text Yes Finance
City/State CityState Text Yes Finance
ZIP Code ZIP ZIP code Yes Finance
Refund Amount Amount Text Yes Finance
Cost Center CostCenter Text Yes Cost centre Finance
PaymentCode PaymentCode Dropdown Yes Finance
Entity Entity Dropdown Yes Finance
Reason for Refund Reason Text Yes Finance

Human Resources

Change of Address Notification

change-of-address-notification · 7 fields · 2 copies · retained 7 years

Receives a copy Channel Template
Finance Email Finance Address Change Template
HR / People Team HappyFox ticket queue HR Address Change Template
Field Key Type Required Sensitivity Receives
Employee/Addressee Employee Text Yes Finance, HR / People Team
New Address (line 1) Address1 Text Finance, HR / People Team
New Address (line 2) Address2 Text Finance, HR / People Team
City City Text Yes Finance, HR / People Team
State State Text Yes Finance, HR / People Team
ZIP Code ZIP ZIP code Yes Finance, HR / People Team
Check Here If You Are Moving to a New State NewState Checkbox HR / People Team

Contract Extension Notification

contract-extension-notification · 6 fields · 3 copies · retained 7 years

Receives a copy Channel Template
Finance HappyFox ticket queue Contract Extension Notification Template
HR / People Team HappyFox ticket queue Contract Extension Notification Template
IT Accounts HappyFox ticket queue Contract Extension Notification Template
Field Key Type Required Sensitivity Receives
First Name FirstName Text Yes Finance, HR / People Team, IT Accounts
Last Name LastName Text Yes Finance, HR / People Team, IT Accounts
DOL Status DOLStatus Dropdown Yes Finance, HR / People Team, IT Accounts
Beginning Date of Extension: BegExtDate Date Yes Finance, HR / People Team, IT Accounts
End Date of Extension: EndExtDate Date Yes Finance, HR / People Team, IT Accounts
Notes NotesComment Text Finance, HR / People Team, IT Accounts

Employee Termination Notification

employee-termination-notification · 16 fields · 7 copies · retained 7 years

Receives a copy Channel Template
Data Requests HappyFox ticket queue IT Termination Template
Data Team Email IT Termination Template
Facilities Email Facilities Termination Template
Finance HappyFox ticket queue IT Termination Template
Finance Email Facilities Termination Template
HR / People Team Email HR Termination Template
IT Accounts HappyFox ticket queue IT Termination Template
Field Key Type Required Sensitivity Receives
Departee First Name (Given Name) FirstName Text Yes Data Requests, Data Team, Facilities, Finance, HR / People Team, IT Accounts
Departee Last Name (Surname) LastName Text Yes Data Requests, Data Team, Facilities, Finance, HR / People Team, IT Accounts
Departee Personal Email PersonalEmail Text Yes Personal contact HR / People Team
Title Title Text Yes Data Requests, Data Team, Facilities, Finance, HR / People Team, IT Accounts
Manager Manager Text Yes Data Requests, Data Team, Facilities, Finance, HR / People Team, IT Accounts
Location Location Dropdown Yes Data Requests, Data Team, Facilities, Finance, HR / People Team, IT Accounts
Cost Center CostCenter Text Yes Cost centre Data Requests, Data Team, Facilities, Finance, HR / People Team, IT Accounts
Termination Priority Priority Dropdown Data Requests, Data Team, Facilities, Finance, HR / People Team, IT Accounts
Redirect Inquiries to Manager (email) Referend Text Yes Data Requests, Data Team, Finance, IT Accounts
Last Day TerminationDate Date Data Requests, Data Team, Facilities, Finance, HR / People Team, IT Accounts
HR Termination Codes (For HR Purposes) TerminationCodes Dropdown Yes HR only HR / People Team
Shipping Label/Box Required? ShippingLabel Dropdown Yes Data Requests, Data Team, Finance, HR / People Team, IT Accounts
Address Address Text Data Requests, Data Team, Finance, HR / People Team, IT Accounts
City/State CityState Text Data Requests, Data Team, Finance, HR / People Team, IT Accounts
Contact Phone Phone Text Data Requests, Data Team, Finance, HR / People Team, IT Accounts
Note Note Text Data Requests, Data Team, Facilities, Finance, HR / People Team, IT Accounts

Human Resources Support Request

human-resources-support-request · 2 fields · 1 copies · retained 7 years

Receives a copy Channel Template
HR / People Team HappyFox ticket queue HR Support Request Template
Field Key Type Required Sensitivity Receives
Issue Subject Text Yes HR / People Team
Description Description Long text Yes HR / People Team

Laptop Retrieval Notification

laptop-retrieval-notification · 9 fields · 2 copies · retained 7 years

Receives a copy Channel Template
HR / People Team HappyFox ticket queue Laptop Retrieval Request Template
IT Accounts HappyFox ticket queue Laptop Retrieval Request Template
Field Key Type Required Sensitivity Receives
First Name FirstName Text Yes HR / People Team, IT Accounts
Last Name LastName Text Yes HR / People Team, IT Accounts
City City Text Yes HR / People Team, IT Accounts
ZIP Code ZIP Text HR / People Team, IT Accounts
State State Text Yes HR / People Team, IT Accounts
Employee Personal Phone Phone Text HR / People Team, IT Accounts
Employee Personal Email Email Text Yes HR / People Team, IT Accounts
Cost Center CostCenter Text Cost centre HR / People Team, IT Accounts
Notes Notes Text HR / People Team, IT Accounts

Manager Change Request Notification

manager-change-request-notification · 9 fields · 2 copies · retained 7 years

Receives a copy Channel Template
HR / People Team HappyFox ticket queue Manager Change Request Template
IT Support HappyFox ticket queue Manager Change Request Template
Field Key Type Required Sensitivity Receives
Name of direct reports - Affected employees EmployeeAffected Text Yes HR / People Team, IT Support
Currently reporting to CurrentManager Text Yes HR / People Team, IT Support
Current time card approver CurrentTimeAppro Text Yes HR / People Team, IT Support
Effective Date of Change Date Date Yes HR / People Team, IT Support
New reporting manager NewManager Text Yes HR / People Team, IT Support
New Time card approver NewApprover Text Yes HR / People Team, IT Support
Is this a permanent change? (Yes/No) PermanentChange Dropdown Yes HR / People Team, IT Support
Start Date StartDate Date Yes HR / People Team, IT Support
End Date EndDate Date Yes HR / People Team, IT Support

New Employee Notification

new-employee-notification · 52 fields · 6 copies · retained 7 years

Receives a copy Channel Template
Data Requests HappyFox ticket queue General New Employee Template
Facilities Email General New Employee Template
Finance HappyFox ticket queue General New Employee Template
HR / People Team Email HR New Employee Template
IT Accounts Email IT New Employee Template
IT Accounts Email General New Employee Template
Field Key Type Required Sensitivity Receives
First Name (Given Name) FirstName Text Yes Data Requests, Facilities, Finance, HR / People Team, IT Accounts
Last Name (Surname) LastName Text Yes Data Requests, Facilities, Finance, HR / People Team, IT Accounts
Preferred Name PreferredName Text IT Accounts
Personal E-mail Address EmailAddress Text Yes Data Requests, Facilities, Finance, HR / People Team, IT Accounts
Personal Phone Number (Mandatory for Remote Staff) PersonalNumber Text Personal contact Data Requests, Facilities, Finance, HR / People Team, IT Accounts
Mailing Address MailingAddress Text Yes Personal contact Data Requests, Facilities, Finance, HR / People Team, IT Accounts
Title Title Text Yes Data Requests, Facilities, Finance, HR / People Team, IT Accounts
Department Department Text Yes HR / People Team, IT Accounts
Timesheet Approval (if different than manager) TimeApproval Text Compensation HR / People Team
Project Code ProjectCode Text Yes Cost centre HR / People Team
Manager Manager Text Yes Data Requests, Facilities, Finance, HR / People Team, IT Accounts
Salary Salary Text Compensation HR / People Team
Hourly Rate HourlyRate Text Compensation HR / People Team
Salary Band SalaryBand Text Compensation HR / People Team
Notes Notes Text
Additional PTO? AdditionalPTO Text Benefits HR / People Team
EEO1 EEO1 Dropdown Yes EEO / protected class HR / People Team
Super Department SuperDepartment Dropdown Yes HR / People Team
Pay Scale Payscale Dropdown Yes Compensation HR / People Team
DOL Status DOLStatus Dropdown Yes Data Requests, Facilities, Finance, HR / People Team, IT Accounts
Notes for IT Notesforit Text IT Accounts
Grant Funded ? (Yes/No) GrantFunded Dropdown Yes Grant funding HR / People Team
Rehire? Rehire Checkbox HR / People Team
Name of the Grant NameOfTheGrant Text Yes Grant funding HR / People Team
New Position (Yes/No) NewPosition Dropdown Yes HR / People Team
Location OfficeLocation Dropdown Yes Data Requests, Facilities, Finance, HR / People Team, IT Accounts
Management Position (Yes/No) MgmtPosition Dropdown Yes Employment terms HR / People Team
Exempt Type ExemptType Dropdown Yes Employment terms HR / People Team
End Date EndDate Date Yes Data Requests, Facilities, Finance, HR / People Team, IT Accounts
Receives Insurance? Insurance Checkbox Yes Benefits HR / People Team
Bargain Type BargainType Dropdown Yes Employment terms HR / People Team
Start Date StartDate Date Yes Data Requests, Facilities, Finance, HR / People Team, IT Accounts
Paid PTO? PaidPTO Checkbox Benefits HR / People Team
Greenpeace Inc % GPInc Number Grant funding HR / People Team
Greenpeace Fund % GPFund Number Grant funding HR / People Team
Employee Location ExtendedLocation Text Data Requests, Facilities, Finance, HR / People Team, IT Accounts
Core Cost Center CoreCostCenter Text
Payroll Cost Center PayrollCostCente Text Yes Compensation HR / People Team
Expense Account Cost Center ExpenseCostCente Text
Notes Notes_2 Long text
Check if Employee will use Phone NeedsExtension Checkbox Data Requests, Facilities, Finance, IT Accounts
Computer Employee will use NeedsWorkstation Dropdown Data Requests, Facilities, Finance, IT Accounts
Laptop Type LaptopType Dropdown Yes IT Accounts
Workstation MAC Address MACAddress Text
Include Office Phone Number BCIncludeOfficeP Checkbox
Include Mobile Phone Number BCIncludeMobileP Checkbox
Include Greenpace E-mail Address BCIncludeGPEmail Checkbox
Telephone Extension PhoneExtension Text
Jack Number JackNumber Text
Sharing Greenpeace Computer? Sharing Checkbox
Sharing with SharingWith Text Data Requests, Facilities, Finance, IT Accounts
Desk Location DeskLocation Text Data Requests, Facilities, Finance, IT Accounts

New Employee Notification - Contractor/Intern

new-employee-notification-contractor-intern · 12 fields · 3 copies · retained 7 years

Receives a copy Channel Template
Finance HappyFox ticket queue New Employee -Contract/Intern Template
HR / People Team HappyFox ticket queue New Employee -Contract/Intern Template
IT Accounts HappyFox ticket queue New Employee -Contract/Intern Template
Field Key Type Required Sensitivity Receives
First Name FirstName Text Yes Finance, HR / People Team, IT Accounts
Last Name LastName Text Yes Finance, HR / People Team, IT Accounts
Email Address Email Text Yes Finance, HR / People Team, IT Accounts
Phone Number Phone Text Yes Finance, HR / People Team, IT Accounts
Role Title RoleTitle Text Yes Finance, HR / People Team, IT Accounts
Start Date StartDate Date Yes Finance, HR / People Team, IT Accounts
End Date EndDate Date Yes Finance, HR / People Team, IT Accounts
Hiring Manager Manager Text Yes Finance, HR / People Team, IT Accounts
Employment Type EmpType Dropdown Yes Finance, HR / People Team, IT Accounts
Extension Date ExtDate Date Yes Finance, HR / People Team, IT Accounts
Department Department Text Yes Finance, HR / People Team, IT Accounts
Super Department SuperDept Dropdown Yes Finance, HR / People Team, IT Accounts

Office Transfer Notification

office-transfer-notification · 5 fields · 3 copies · retained 7 years

Receives a copy Channel Template
Facilities HappyFox ticket queue Facilities Office Transfer Template
HR / People Team Email HR Office Transfer Template
IT Accounts Email IT Office Transfer Template
Field Key Type Required Sensitivity Receives
First Name (Given Name) FirstName Text Yes Facilities, HR / People Team, IT Accounts
Last Name (Surname) LastName Text Yes Facilities, HR / People Team, IT Accounts
New Location City NewCity Text Yes Facilities, HR / People Team, IT Accounts
New Desk Location DeskLocation Text Facilities
Needs Building Access Card NeedsCard Checkbox Facilities

Office Visitors Notification

office-visitors-notification · 15 fields · 2 copies · retained 7 years

Receives a copy Channel Template
Facilities Email Office Visitors Notification Template
IT Support HappyFox ticket queue Office Visitors Notification Template
Field Key Type Required Sensitivity Receives
Location Location Dropdown Yes Facilities, IT Support
Number of people visiting Visitors Text Yes Facilities, IT Support
Dates and times they'll be in the office When Text Yes Facilities, IT Support
Names and Affiliations Who Long text Yes Facilities, IT Support
Purpose of visit Purpose Text Facilities, IT Support
Point person for directing questions Point Text Yes Facilities, IT Support
Network Use Network Dropdown Yes Facilities, IT Support
Number of computers requested Computers Text Yes Facilities, IT Support
Other IT requests ITRequests Text Facilities, IT Support
Number of desk spaces requested Desks Text Yes Facilities, IT Support
Number of landline phones requested Phones Text Yes Facilities, IT Support
Number of loner cell phones requested Cellphones Text Yes Facilities, IT Support
Number of access cards requested Cards Text Yes Facilities, IT Support
Number of Greenpeace apartments requested — (Specify how many and which nights) Apartments Long text Yes Facilities, IT Support
Other notes Notes Long text Facilities, IT Support

Rate/Position Change Notification

rate-position-change-notification · 32 fields · 3 copies · retained 7 years

Receives a copy Channel Template
Finance HappyFox ticket queue IT Position Change Template
HR / People Team HappyFox ticket queue HR Position Change Template
IT Accounts HappyFox ticket queue IT Position Change Template
Field Key Type Required Sensitivity Receives
Personal Phone Number PhoneNumber Text Yes HR / People Team
Employee Email Email Text Yes HR / People Team
Employee Address Address Text Yes HR / People Team
Employee Name Name Text Yes Finance, HR / People Team, IT Accounts
Former Job Title FormerTitle Text Yes
Former Department FormerDepartment Text Yes
New Department NewDepartment Text Yes Finance, IT Accounts
New Position (Yes/No) NewPosition Dropdown Yes HR / People Team
New Hourly Rate NewHourlyRate Text Yes Compensation HR / People Team
Management Position (Yes/No) Mgmtposition Dropdown Yes Employment terms HR / People Team
New Salary NewSalary Text Yes Compensation HR / People Team
If Management , will this position have a direct report (Yes/No) IfMgmtposition Dropdown Yes
New Job Title Title Text Yes Finance, HR / People Team, IT Accounts
New Manager Manager Text Yes Finance, HR / People Team, IT Accounts
Project Code ProjectCode Text Yes Cost centre HR / People Team
New Salary Band SalaryBand Text Compensation HR / People Team
New Payroll Approval PayrollApproval Text Compensation HR / People Team
New Payroll Cost Center CostCenter Text Cost centre Finance, HR / People Team, IT Accounts
Pay Scale PayScale Dropdown Yes Compensation HR / People Team
Location Location Dropdown Yes Finance, HR / People Team, IT Accounts
Super Department SuperDepartment Dropdown Yes HR / People Team
Bargain Type (In/Out) BargainType Dropdown Yes Employment terms HR / People Team
EEO1 EEO1 Dropdown Yes EEO / protected class HR / People Team
Laptop Required LaptopRequired Dropdown Finance, IT Accounts
Effective Date Date Date Finance, HR / People Team, IT Accounts
Laptop Type LaptopType Dropdown Finance, HR / People Team, IT Accounts
DOL Status DOLStatus Dropdown Yes Finance, HR / People Team, IT Accounts
Email Change EmailChange Dropdown Finance, IT Accounts
Notes Notes Long text Yes HR / People Team
Exempt Type ExemptStatus Dropdown Yes Employment terms HR / People Team
Greenpeace Inc % GPInc Number Grant funding HR / People Team
Greenpeace Fund % GPFund Number Grant funding HR / People Team

Finance & Accounting

Finance Support Request

finance-support-request · 2 fields · 1 copies · retained 7 years

Receives a copy Channel Template
Finance Email Finance Support Request Template
Field Key Type Required Sensitivity Receives
Issue Subject Text Yes Finance
Description Description Long text Yes Finance

Facilities

Facilities Support Request

facilities-support-request · 2 fields · 1 copies · retained 7 years

Receives a copy Channel Template
Facilities Email Facilities Support Request Template
Field Key Type Required Sensitivity Receives
Issue Subject Text Yes Facilities
Description Description Long text Yes Facilities

Other

Data Analysis Request

data-analysis-request · 6 fields · 1 copies · retained 7 years

Receives a copy Channel Template
Data Team Email Data Analysis Request
Field Key Type Required Sensitivity Receives
What (simple description of the analysis) What Text Yes Data Team
Who (the population the analysis applies to) Who Text Yes Data Team
When (applicable date range(s)) When Text Yes Data Team
Why (who are the end-users/audience) Why Text Yes Data Team
Description (clarifying details of requested analysis, connect the who/what/when/why) Description Long text Data Team
References (server locations of any relevant data) References Long text Data Team

Data Request Form

data-request-form · 68 fields · 1 copies · retained 7 years

Receives a copy Channel Template
Data Team Email Data Request Form Template
Field Key Type Required Sensitivity Receives
Brief Summary of Project Summary Text Yes Data Team
Due Date Due Date Yes Data Team
Account Status Status Dropdown Yes Data Team
Contact Method ContactMethod Dropdown Yes Data Team
Attachment Attachment File upload
Individual Individual Checkbox Data Team
Corporation Corporation Checkbox Data Team
Foundation Foundation Checkbox Data Team
Family Foundation FamilyFoundatio Checkbox Data Team
Donor Advised Fund DonorAdvisedFu Checkbox Data Team
Estate Estate Checkbox Data Team
Combined Federal Campaign CFC Checkbox Data Team
Matching Gift Company MatchingGiftCo Checkbox Data Team
No Contact NoCont Checkbox Data Team
Do Not Mail NOCONTMAIL Checkbox Data Team
No Mail Appeals NOMAIL Checkbox Data Team
No Renewals NORENEW Checkbox Data Team
One Renewal Notice R1 Checkbox Data Team
Email Only EMONLY Checkbox Data Team
Two Solicitations per Year SOL2 Checkbox Data Team
Three Solicitations per Year SOL3 Checkbox Data Team
No Sustainer Invites NOSUST Checkbox Data Team
No Installment Reminders NOREMIND Checkbox Data Team
Year-End Solicitation Only SOL1 Checkbox Data Team
Spring Solicitation Only SOL1SP Checkbox Data Team
No Pre-stamped Reply NOSTAMP Checkbox Data Team
Do Not Solicit for Pia PIANOSOL Checkbox Data Team
No Telephone Contact NOCONTPHONE Checkbox Data Team
No Telephone Appeals NOPHONE Checkbox Data Team
Phone Contact Only PHONE Checkbox Data Team
No Email Renewals NOEMRENEW Checkbox Data Team
No Email Special Appeals NOEMAIL Checkbox Data Team
No Email Contact NOCONTEMAIL Checkbox Data Team
Do Not Visit NOVISIT Checkbox Data Team
No Exchange NOEXCHANGE Checkbox Data Team
No Planned Giving Mail NOPGMAIL Checkbox Data Team
No Planned Giving Calls NOPGPHONE Checkbox Data Team
Deceased TCDC Checkbox Data Team
Invalid Accounts IORD Checkbox Data Team
Invalid Address OORU Checkbox Data Team
CFC Donors CFC_2 Checkbox Data Team
Financial Advisor Network FAN Checkbox Data Team
MG Prospects PROSPECT Checkbox Data Team
Complimentary Magazine MAGCOMP Checkbox Data Team
Libraries and Institutions LIBRARY Checkbox Data Team
No Inside GP NODONPUB Checkbox Data Team
No Premiums or Gifts NOPREM Checkbox Data Team
No Greenpeace Update NOPUB Checkbox Data Team
No Greenpeace Calendars NOCALENDAR Checkbox Data Team
No Annual Report NOANNRPT Checkbox Data Team
No Planned Giving Newsletter NOPGNEWS Checkbox Data Team
No Event Invitations NOINVITE Checkbox Data Team
Invalid Phone Numbers PhonenotActive Checkbox Data Team
No Phone Number NullPhone Checkbox Data Team
Bequests BEQ Checkbox Data Team
Sustainers SGORPLEDGE Checkbox Data Team
Celebrities CEL Checkbox Data Team
GP Circle GPC Checkbox Data Team
Special Partners SPECIAL Checkbox Data Team
Prospects PROSPECT_2 Checkbox Data Team
Canceled SGs SGCANCEL Checkbox Data Team
Estate Accounts ES Checkbox Data Team
Custom Excludes CustomExcludes Long text Data Team
Standard Mail GPMAIL Checkbox Data Team
Standard Telemarketing GPTM Checkbox Data Team
GP Telematch GPTelematch Checkbox Data Team
Customized Salutation Sender (if any) CustomSalutation Text Data Team
Customized Output (list fields to include) CustomizedOutpu Long text Data Team

Database Account Access Request

database-account-access-request · 4 fields · 1 copies · retained 7 years

Receives a copy Channel Template
Data Team Email Database Account Access Request
Field Key Type Required Sensitivity Receives
Title/Position TitlePosition Text Data Team
Database Database Dropdown Data Team
Requested Action Request Dropdown Data Team
Purpose/Description Purpose Long text Data Team

Database Support Request

database-support-request · 5 fields · 1 copies · retained 7 years

Receives a copy Channel Template
Data Team Email Database Support Request
Field Key Type Required Sensitivity Receives
Database Database Dropdown Data Team
Support Requested Request Dropdown Data Team
Cited URL (if any) URL Text Data Team
Description Description Long text Data Team
Example Example Long text Data Team

Database Training Request

database-training-request · 2 fields · 1 copies · retained 7 years

Receives a copy Channel Template
Data Team Email Database Training Request
Field Key Type Required Sensitivity Receives
For whom (if not yourself) For Text Data Team
Database Database Dropdown Data Team

Photo Licensing Request

photo-licensing-request · 12 fields · 1 copies · retained 7 years

Receives a copy Channel Template
(no destination set) Email (undeliverable) Photo Licensing Template
Field Key Type Required Sensitivity Receives
Deadline Deadline Text NO DESTINATION SET
Requestor's Name Name Text Yes NO DESTINATION SET
Publication Publication Text NO DESTINATION SET
City/State CityState Text NO DESTINATION SET
Contact Phone Phone Text Yes NO DESTINATION SET
Contact Email Email Text Yes NO DESTINATION SET
Details of Your Request (please be specific) Details Long text Yes NO DESTINATION SET
Photo Medium Medium Dropdown Yes NO DESTINATION SET
Distribution Area Distribution Text NO DESTINATION SET
Estimated Circulation Circulation Text NO DESTINATION SET
Reference URL(s) URL Text NO DESTINATION SET
Sector Sector Dropdown Yes NO DESTINATION SET

Project Planning Facilitation Request

project-planning-facilitation-request · 6 fields · 1 copies · retained 7 years

Receives a copy Channel Template
(no destination set) Email (undeliverable) Project Facilitator Template
Field Key Type Required Sensitivity Receives
Requestor's Name RequestorName Text Yes NO DESTINATION SET
Point of Contact Contact Text Yes NO DESTINATION SET
Project Name Name Text Yes NO DESTINATION SET
Project Description Description Long text Yes NO DESTINATION SET
Project Timeline Timeline Text Yes NO DESTINATION SET
Facilitations Facilitations Dropdown Yes NO DESTINATION SET

Research Request

research-request · 5 fields · 1 copies · retained 7 years

Receives a copy Channel Template
(no destination set) Email (undeliverable) Research Request Template
Field Key Type Required Sensitivity Receives
Summary of Research Needs: Subject Text Yes NO DESTINATION SET
Campaign/Project Campaign Text Yes NO DESTINATION SET
Research Timeline/Due Date Timeline Text NO DESTINATION SET
Researcher Researcher Dropdown NO DESTINATION SET
Extended Description/Notes Description Long text Yes NO DESTINATION SET

Video Licensing Request

video-licensing-request · 10 fields · 1 copies · retained 7 years

Receives a copy Channel Template
(no destination set) Email (undeliverable) Video Licensing Template
Field Key Type Required Sensitivity Receives
Deadline Deadline Text NO DESTINATION SET
Requestor's Name Name Text Yes NO DESTINATION SET
Publication Publication Text NO DESTINATION SET
City/State CityState Text NO DESTINATION SET
Contact Phone Phone Text Yes NO DESTINATION SET
Contact Email Email Text Yes NO DESTINATION SET
Details of Your Request (please be specific) Details Long text Yes NO DESTINATION SET
Display Duration Display Dropdown Yes NO DESTINATION SET
Reference URL(s) URL Text NO DESTINATION SET
Sector Sector Dropdown Yes NO DESTINATION SET

7. Owner reviews

Per-owner review copies — each function's forms, field by field, with a decision column — are staged in governance/reviews/ and listed in that directory's README.md. They are the durable record of what was sent out for audit and to whom.

7.1 Departmental review status

Function Reviewer Review document Issued Status
HR / People Taylor governance/reviews/HR-Field-Audit-2026-08-03.docx 2026-08-03 ✅ reviewed
IT Jack, Tanu governance/it-forms-field-audit-2026-08-04.md 2026-08-04 🕐 pending
Finance governance/reviews/Finance-Field-Audit-2026-08-03.docx 2026-08-03 — not issued
Facilities governance/reviews/Facilities-Field-Audit-2026-08-03.docx 2026-08-03 — not issued
Data Team governance/reviews/Data-Team-Field-Audit-2026-08-03.docx 2026-08-03 — not issued

HR / People — ✅ reviewed. Returned with decisions. Confirmed the cost-centre and laptop routing gaps; both closed in commit 89ebf11 and verified live on 2026-08-04.

IT — 🕐 pending. 14 forms across three ownership tiers, read from live production 2026-08-04. Eight decisions requested; see that page's §5.

Why the two issued reviews have different formats

The 2026-08-03 reviews were issued as .docx working copies with a blank Decision column, generated by gen_owner_reviews.py. The IT review is a published portal page instead, because it needed a per-field × per-destination matrix and an ownership-tier rationale that the generator does not produce. The 2026-08-03 .docx copies are deliberately not regenerated — they are the record of what was actually sent to each owner, and rewriting them in place would alter a document already under review. The EMAIL_OWNERS fix above therefore changes this page and the next issue, not the copies already out.

  • governance/it-forms-field-audit-2026-08-04.md — the IT departmental review: 14 forms across three ownership tiers, with a per-field × per-destination matrix.
  • governance/forms-field-exposure-matrix.md — the narrower cross-department leak check (sensitive fields per template). This audit supersedes it for coverage but the matrix remains the fast CI guard.
  • infrastructure/runbooks/forms-db-access.md — access paths to gpus-forms-db.
  • architecture/forms-phase2.5c-design.md — the per-action routing model.