Forms Portal — IT Departmental Field Audit — 2026-08-04¶

Classification: CONFIDENTIAL — Internal Use Only Document: governance/it-forms-field-audit-2026-08-04.md · v1.0 · 2026-08-04 · GPUS-IT Reviewers: Jack, Tanu · Status: 🕐 pending · Issued 2026-08-04

1. What this is, and what is being asked of you¶

This is the IT departmental review copy of the forms-portal field audit. The master control and its portal-wide findings live in forms-field-audit.md; this page narrows it to the forms IT owns or acts on, and asks IT for eight decisions.

It answers one question for every field on every IT form: who actually receives this answer? Not who is supposed to — who does, in production, today.

The tables in §4 have a blank Decision column. Fill it in with keep, remove or change and return the page (or a diff against it). §5 lists the eight items that need a decision; the rest of the table is there so a decision is never made without the surrounding context.

A merge to main is a production routing change

forms-backend/app.py calls load_all() on every container boot unless FORMS_SKIP_YAML_BOOT=1 is set, so any push that redeploys the backend applies forms/*.yaml to the live actions table immediately. There is no separate approval gate between a merged decision and live routing.

2. How this was produced¶

Read from the live production database, not from the repository. The routing worker dispatches from the actions table, so a change committed but not reloaded is not in force — auditing the repo reports intent, auditing the database reports reality.


Source	live production `gpus_forms`
Path	VPN → MAPLE `172.16.0.12` → `cloud-sql-proxy` → `gpus-forms-db`
Read as	`maple-agent@gpus-infra.iam` (no break-glass grant, no impersonation)
Read on	2026-08-04 13:33 UTC
Method	`governance/scripts/fetch_live.sh` → `build_audit.py`
Portal-wide	28 forms · 320 fields · 64 actions · 46 templates
This review	14 forms · 178 fields · 36 delivery legs · 13 legs addressed to an IT queue

Repo-vs-production drift: none. The 2026-08-04 pull is byte-identical to the 2026-08-03 pull across forms, fields, actions and templates (0 added, 0 removed, 0 changed), and the template edits from commit 89ebf11 were confirmed present in the live template bodies. Intent and reality agree.

Why the template is the access boundary¶

One submission does not go to one place. It fans out to several destinations, and each destination renders its own template against the same field values. A template that does not reference {{ Field }} does not show that field to that queue. So the per-queue template is the access control — which is why every table below has one column per destination rather than a single "who gets it" column. See gpus-forms-routing-worker/template_render.py.

3. The ownership boundary — which forms are in scope, and why¶

Three tiers, because "IT-owned" and "IT-delivered" select different sets and the boundary question sits between them. Please confirm or correct this classification first — every decision in §5 depends on it.

Tier	Basis	Forms
A	IT-owned (portal category = Information Technology)	4
B	Primarily routing to IT (sole or co-primary destination)	4
C	HR-owned lifecycle; IT executes provisioning/deprovisioning	6
	Total	14

Two forms here were missing from the 2026-08-03 IT review copy. That copy scoped IT as "has at least one delivery leg resolving to IT" and found 12 forms. It excluded:

Data Restoration Request — IT-owned, but its only action has an empty destination, so it resolved to NONE and the delivery filter dropped it.
Frontline Form Request — routes solely to gpus-it-infrastructure@, which was missing from EMAIL_OWNERS and so fell into the individual bucket. Fixed in build_audit.py on 2026-08-04; see §5, F7.

Deliberately excluded. Database Account Access Request, Database Support Request, Database Training Request, Data Analysis Request and Data Request Form — the names read as IT, but every one routes to the Data Team (#85 / gpus-data-request@), not to IT. Also excluded: Refund Processing (Finance), Change of Address (Finance + HR), the HR/Finance/Facilities support requests, and the four licensing and research forms.

4. Per-field × per-destination matrices¶

Each form lists its destination columns first, then every field. Y means that destination's template renders the field; a blank cell means it does not. The Decision column is yours.

Sensitivity classes: Compensation, Grant funding, Benefits, Employment terms, EEO / protected class and HR only are HR-scoped and must not appear in a non-HR copy. Cost centre and Personal contact are shown but operationally permitted outside HR.

Tier A — IT-owned¶

Portal category is Information Technology — IT owns the questions, the routing and the retention.

DHCP Request¶

dhcp-request · category Information Technology · v2 · 7 fields · 1 delivery copy · retained 7 years

Col	Destination	Function	Channel	Template
D1	IT Support `gpus-it-support@greenpeace.org`	IT	Email	DHCP Request Template

Field	Key	Type	Req	Sensitivity	D1
DHCP Entry Type	`DHCPEntryType`	Dropdown	Yes	—	Y
Wireless MAC Address	`WifiMACAddress`	MAC address	—	—	Y
Wired MAC Address	`MACAddress`	MAC address	—	—	Y
For which user (Greenpeace e-mail username)	`User`	Text	Yes	—	Y
Remove from KACE?	`RemoveFromKace`	Checkbox	—	—	Y
Notes	`Notes`	Long text	—	—	Y
Attachment	`Attachment`	File upload	—	—

1 of 7 fields on this form reach no destination.

IT Support Request¶

it-support-request · category Information Technology · v1 · 5 fields · 1 delivery copy · retained 7 years

Col	Destination	Function	Channel	Template
D1	IT Infrastructure `71`	IT	HappyFox ticket queue	IT Support Request Template

Field	Key	Type	Req	Sensitivity	D1
Issue	`Subject`	Text	Yes	—	Y
Description	`Description`	Long text	Yes	—	Y
Error Message (if any)	`Errors`	Long text	—	—	Y
Laptop/Projector Request	`Equipment`	Checkbox	—	—
Dates/Times Needed	`RequestedDates`	Text	—	—	Y

1 of 5 fields on this form reach no destination.

Dynamic DNS Hostname Notification¶

dynamic-dns-hostname-notification · category Information Technology · v1 · 2 fields · 1 delivery copy · retained 7 years

Col	Destination	Function	Channel	Template
D1	IT Support `gpus-it-support@greenpeace.org`	IT	Email	DynDNS Hostname Notification Template

Field	Key	Type	Req	Sensitivity	D1	Decision
DynDNS Hostname	`Hostname`	Text	Yes	—	Y
Requested Action	`RequestedAction`	Dropdown	Yes	—	Y

Data Restoration Request¶

data-restoration-request · category Information Technology · v1 · 5 fields · 1 delivery copy · retained 7 years

Included despite delivering to nobody: an owner must see a form of theirs that sends nothing.

Col	Destination	Function	Channel	Template
D1	(no destination set)	NONE	Email (undeliverable)	Data Restoration Request Template

Field	Key	Type	Req	Sensitivity	D1
Fileserver	`Fileserver`	Dropdown	Yes	—	Y
Share Name (i.e. Everyone or P:)	`Share`	Text	Yes	—	Y
Location (i.e. /xd/accounts/2009/July/inc.xls)	`Pathname`	Text	Yes	—	Y
Deadline (if any)	`Deadline`	Text	—	—	Y
Comments/Requests	`Comments`	Long text	—	—	Y

Tier B — Primarily routing to IT¶

IT is the sole or co-primary destination, though another function owns the form.

Frontline Form Request¶

frontline-form-request · category Supporter Care · v1 · 3 fields · 1 delivery copy · retained 7 years

Sole destination is an IT role address. Missing from the 2026-08-03 IT review copy — see §5, F7.

Col	Destination	Function	Channel	Template
D1	IT Infrastructure `gpus-it-infrastructure@greenpeace.org`	IT	Email	Frontline Form Request

Field	Key	Type	Req	Sensitivity	D1
Location	`Location`	Dropdown	—	—	Y
Range of Dates to Pull	`StartDate`	Date	—	—	Y
Until	`EndDate`	Date	—	—	Y

Office Visitors Notification¶

office-visitors-notification · category Human Resources · v1 · 15 fields · 2 delivery copies · retained 7 years

HR-category, but HR receives no copy; IT Support and Facilities are the only recipients.

Col	Destination	Function	Channel	Template
D1	IT Support `45`	IT	HappyFox ticket queue	Office Visitors Notification Template
D2	Facilities `gpus-facilities@greenpeace.org`	FAC	Email	Office Visitors Notification Template

Field	Key	Type	Req	Sensitivity	D1	D2
Location	`Location`	Dropdown	Yes	—	Y	Y
Number of people visiting	`Visitors`	Text	Yes	—	Y	Y
Dates and times they'll be in the office	`When`	Text	Yes	—	Y	Y
Names and Affiliations	`Who`	Long text	Yes	—	Y	Y
Purpose of visit	`Purpose`	Text	—	—	Y	Y
Point person for directing questions	`Point`	Text	Yes	—	Y	Y
Network Use	`Network`	Dropdown	Yes	—	Y	Y
Number of computers requested	`Computers`	Text	Yes	—	Y	Y
Other IT requests	`ITRequests`	Text	—	—	Y	Y
Number of desk spaces requested	`Desks`	Text	Yes	—	Y	Y
Number of landline phones requested	`Phones`	Text	Yes	—	Y	Y
Number of loner cell phones requested	`Cellphones`	Text	Yes	—	Y	Y
Number of access cards requested	`Cards`	Text	Yes	—	Y	Y
Number of Greenpeace apartments requested — (Specify how many and which nights)	`Apartments`	Long text	Yes	—	Y	Y
Other notes	`Notes`	Long text	—	—	Y	Y

Laptop Retrieval Notification¶

laptop-retrieval-notification · category Human Resources · v2 · 9 fields · 2 delivery copies · retained 7 years

Col	Destination	Function	Channel	Template
D1	IT Accounts `81`	IT	HappyFox ticket queue	Laptop Retrieval Request Template
D2	HR / People Team `92`	HR	HappyFox ticket queue	Laptop Retrieval Request Template

Field	Key	Type	Req	Sensitivity	D1	D2
First Name	`FirstName`	Text	Yes	—	Y	Y
Last Name	`LastName`	Text	Yes	—	Y	Y
City	`City`	Text	Yes	—	Y	Y
ZIP Code	`ZIP`	Text	—	—	Y	Y
State	`State`	Text	Yes	—	Y	Y
Employee Personal Phone	`Phone`	Text	—	—	Y	Y
Employee Personal Email	`Email`	Text	Yes	—	Y	Y
Cost Center	`CostCenter`	Text	—	Cost centre	Y	Y
Notes	`Notes`	Text	—	—	Y	Y

Manager Change Request Notification¶

manager-change-request-notification · category Human Resources · v1 · 9 fields · 2 delivery copies · retained 7 years

Col	Destination	Function	Channel	Template
D1	IT Support `45`	IT	HappyFox ticket queue	Manager Change Request Template
D2	HR / People Team `92`	HR	HappyFox ticket queue	Manager Change Request Template

Field	Key	Type	Req	Sensitivity	D1	D2
Name of direct reports - Affected employees	`EmployeeAffected`	Text	Yes	—	Y	Y
Currently reporting to	`CurrentManager`	Text	Yes	—	Y	Y
Current time card approver	`CurrentTimeAppro`	Text	Yes	—	Y	Y
Effective Date of Change	`Date`	Date	Yes	—	Y	Y
New reporting manager	`NewManager`	Text	Yes	—	Y	Y
New Time card approver	`NewApprover`	Text	Yes	—	Y	Y
Is this a permanent change? (Yes/No)	`PermanentChange`	Dropdown	Yes	—	Y	Y
Start Date	`StartDate`	Date	Yes	—	Y	Y
End Date	`EndDate`	Date	Yes	—	Y	Y

Tier C — HR-owned lifecycle, IT executes¶

HR owns the form; the IT copy is the provisioning or deprovisioning instruction.

New Employee Notification¶

new-employee-notification · category Human Resources · v2 · 52 fields · 6 delivery copies · retained 7 years

Col	Destination	Function	Channel	Template
D1	HR / People Team `gpus-people@greenpeace.org`	HR	Email	HR New Employee Template
D2	IT Accounts `gpus-it-accounts@greenpeace.org`	IT	Email	IT New Employee Template
D3	IT Accounts `gpus-it-accounts@greenpeace.org`	IT	Email	General New Employee Template
D4	Facilities `gpus-facilities@greenpeace.org`	FAC	Email	General New Employee Template
D5	Finance `96`	FIN	HappyFox ticket queue	General New Employee Template
D6	Data Requests `85`	DATA	HappyFox ticket queue	General New Employee Template

Field	Key	Type	Req	Sensitivity	D1	D2	D3	D4	D5	D6
First Name (Given Name)	`FirstName`	Text	Yes	—	Y	Y	Y	Y	Y	Y
Last Name (Surname)	`LastName`	Text	Yes	—	Y	Y	Y	Y	Y	Y
Preferred Name	`PreferredName`	Text	—	—		Y
Personal E-mail Address	`EmailAddress`	Text	Yes	—	Y		Y	Y	Y	Y
Personal Phone Number (Mandatory for Remote Staff)	`PersonalNumber`	Text	—	Personal contact	Y	Y	Y	Y	Y	Y
Mailing Address	`MailingAddress`	Text	Yes	Personal contact	Y	Y	Y	Y	Y	Y
Title	`Title`	Text	Yes	—	Y	Y	Y	Y	Y	Y
Department	`Department`	Text	Yes	—	Y	Y
Timesheet Approval (if different than manager)	`TimeApproval`	Text	—	Compensation	Y
Project Code	`ProjectCode`	Text	Yes	Cost centre	Y
Manager	`Manager`	Text	Yes	—	Y	Y	Y	Y	Y	Y
Salary	`Salary`	Text	—	Compensation	Y
Hourly Rate	`HourlyRate`	Text	—	Compensation	Y
Salary Band	`SalaryBand`	Text	—	Compensation	Y
Notes	`Notes`	Text	—	—
Additional PTO?	`AdditionalPTO`	Text	—	Benefits	Y
EEO1	`EEO1`	Dropdown	Yes	EEO / protected class	Y
Super Department	`SuperDepartment`	Dropdown	Yes	—	Y
Pay Scale	`Payscale`	Dropdown	Yes	Compensation	Y
DOL Status	`DOLStatus`	Dropdown	Yes	—	Y	Y	Y	Y	Y	Y
Notes for IT	`Notesforit`	Text	—	—		Y
Grant Funded ? (Yes/No)	`GrantFunded`	Dropdown	Yes	Grant funding	Y
Rehire?	`Rehire`	Checkbox	—	—	Y
Name of the Grant	`NameOfTheGrant`	Text	Yes	Grant funding	Y
New Position (Yes/No)	`NewPosition`	Dropdown	Yes	—	Y
Location	`OfficeLocation`	Dropdown	Yes	—	Y	Y	Y	Y	Y	Y
Management Position (Yes/No)	`MgmtPosition`	Dropdown	Yes	Employment terms	Y
Exempt Type	`ExemptType`	Dropdown	Yes	Employment terms	Y
End Date	`EndDate`	Date	Yes	—	Y	Y	Y	Y	Y	Y
Receives Insurance?	`Insurance`	Checkbox	Yes	Benefits	Y
Bargain Type	`BargainType`	Dropdown	Yes	Employment terms	Y
Start Date	`StartDate`	Date	Yes	—	Y	Y	Y	Y	Y	Y
Paid PTO?	`PaidPTO`	Checkbox	—	Benefits	Y
Greenpeace Inc %	`GPInc`	Number	—	Grant funding	Y
Greenpeace Fund %	`GPFund`	Number	—	Grant funding	Y
Employee Location	`ExtendedLocation`	Text	—	—	Y	Y	Y	Y	Y	Y
Core Cost Center	`CoreCostCenter`	Text	—	—
Payroll Cost Center	`PayrollCostCente`	Text	Yes	Compensation	Y
Expense Account Cost Center	`ExpenseCostCente`	Text	—	—
Notes	`Notes_2`	Long text	—	—
Check if Employee will use Phone	`NeedsExtension`	Checkbox	—	—			Y	Y	Y	Y
Computer Employee will use	`NeedsWorkstation`	Dropdown	—	—		Y	Y	Y	Y	Y
Laptop Type	`LaptopType`	Dropdown	Yes	—		Y
Workstation MAC Address	`MACAddress`	Text	—	—
Include Office Phone Number	`BCIncludeOfficeP`	Checkbox	—	—
Include Mobile Phone Number	`BCIncludeMobileP`	Checkbox	—	—
Include Greenpace E-mail Address	`BCIncludeGPEmail`	Checkbox	—	—
Telephone Extension	`PhoneExtension`	Text	—	—
Jack Number	`JackNumber`	Text	—	—
Sharing Greenpeace Computer?	`Sharing`	Checkbox	—	—
Sharing with	`SharingWith`	Text	—	—		Y	Y	Y	Y	Y
Desk Location	`DeskLocation`	Text	—	—		Y	Y	Y	Y	Y

11 of 52 fields on this form reach no destination.

New Employee Notification - Contractor/Intern¶

new-employee-notification-contractor-intern · category Human Resources · v1 · 12 fields · 3 delivery copies · retained 7 years

Col	Destination	Function	Channel	Template
D1	IT Accounts `81`	IT	HappyFox ticket queue	New Employee -Contract/Intern Template
D2	HR / People Team `92`	HR	HappyFox ticket queue	New Employee -Contract/Intern Template
D3	Finance `96`	FIN	HappyFox ticket queue	New Employee -Contract/Intern Template

Field	Key	Type	Req	Sensitivity	D1	D2	D3
First Name	`FirstName`	Text	Yes	—	Y	Y	Y
Last Name	`LastName`	Text	Yes	—	Y	Y	Y
Email Address	`Email`	Text	Yes	—	Y	Y	Y
Phone Number	`Phone`	Text	Yes	—	Y	Y	Y
Role Title	`RoleTitle`	Text	Yes	—	Y	Y	Y
Start Date	`StartDate`	Date	Yes	—	Y	Y	Y
End Date	`EndDate`	Date	Yes	—	Y	Y	Y
Hiring Manager	`Manager`	Text	Yes	—	Y	Y	Y
Employment Type	`EmpType`	Dropdown	Yes	—	Y	Y	Y
Extension Date	`ExtDate`	Date	Yes	—	Y	Y	Y
Department	`Department`	Text	Yes	—	Y	Y	Y
Super Department	`SuperDept`	Dropdown	Yes	—	Y	Y	Y

Employee Termination Notification¶

employee-termination-notification · category Human Resources · v3 · 16 fields · 7 delivery copies · retained 7 years

Col	Destination	Function	Channel	Template
D1	HR / People Team `gpus-people@greenpeace.org`	HR	Email	HR Termination Template
D2	IT Accounts `81`	IT	HappyFox ticket queue	IT Termination Template
D3	Data Requests `85`	DATA	HappyFox ticket queue	IT Termination Template
D4	Finance `96`	FIN	HappyFox ticket queue	IT Termination Template
D5	Facilities `gpus-facilities@greenpeace.org`	FAC	Email	Facilities Termination Template
D6	Finance `gpus-finance-support@greenpeace.org`	FIN	Email	Facilities Termination Template
D7	Data Team `gpus-data-request@greenpeace.org`	DATA	Email	IT Termination Template

Field	Key	Type	Req	Sensitivity	D1	D2	D3	D4	D5	D6	D7
Departee First Name (Given Name)	`FirstName`	Text	Yes	—	Y	Y	Y	Y	Y	Y	Y
Departee Last Name (Surname)	`LastName`	Text	Yes	—	Y	Y	Y	Y	Y	Y	Y
Departee Personal Email	`PersonalEmail`	Text	Yes	Personal contact	Y
Title	`Title`	Text	Yes	—	Y	Y	Y	Y	Y	Y	Y
Manager	`Manager`	Text	Yes	—	Y	Y	Y	Y	Y	Y	Y
Location	`Location`	Dropdown	Yes	—	Y	Y	Y	Y	Y	Y	Y
Cost Center	`CostCenter`	Text	Yes	Cost centre	Y	Y	Y	Y	Y	Y	Y
Termination Priority	`Priority`	Dropdown	—	—	Y	Y	Y	Y	Y	Y	Y
Redirect Inquiries to Manager (email)	`Referend`	Text	Yes	—		Y	Y	Y			Y
Last Day	`TerminationDate`	Date	—	—	Y	Y	Y	Y	Y	Y	Y
HR Termination Codes (For HR Purposes)	`TerminationCodes`	Dropdown	Yes	HR only	Y
Shipping Label/Box Required?	`ShippingLabel`	Dropdown	Yes	—	Y	Y	Y	Y			Y
Address	`Address`	Text	—	—	Y	Y	Y	Y			Y
City/State	`CityState`	Text	—	—	Y	Y	Y	Y			Y
Contact Phone	`Phone`	Text	—	—	Y	Y	Y	Y			Y
Note	`Note`	Text	—	—	Y	Y	Y	Y			Y

Contract Extension Notification¶

contract-extension-notification · category Human Resources · v1 · 6 fields · 3 delivery copies · retained 7 years

Col	Destination	Function	Channel	Template
D1	IT Accounts `81`	IT	HappyFox ticket queue	Contract Extension Notification Template
D2	Finance `96`	FIN	HappyFox ticket queue	Contract Extension Notification Template
D3	HR / People Team `92`	HR	HappyFox ticket queue	Contract Extension Notification Template

Field	Key	Type	Req	Sensitivity	D1	D2	D3
First Name	`FirstName`	Text	Yes	—	Y	Y	Y
Last Name	`LastName`	Text	Yes	—	Y	Y	Y
DOL Status	`DOLStatus`	Dropdown	Yes	—	Y	Y	Y
Beginning Date of Extension:	`BegExtDate`	Date	Yes	—	Y	Y	Y
End Date of Extension:	`EndExtDate`	Date	Yes	—	Y	Y	Y
Notes	`NotesComment`	Text	—	—	Y	Y	Y

Office Transfer Notification¶

office-transfer-notification · category Human Resources · v1 · 5 fields · 3 delivery copies · retained 7 years

Col	Destination	Function	Channel	Template
D1	HR / People Team `gpus-people@greenpeace.org`	HR	Email	HR Office Transfer Template
D2	IT Accounts `gpus-it-accounts@greenpeace.org`	IT	Email	IT Office Transfer Template
D3	Facilities `100`	FAC	HappyFox ticket queue	Facilities Office Transfer Template

Field	Key	Type	Req	Sensitivity	D1	D2	D3
First Name (Given Name)	`FirstName`	Text	Yes	—	Y	Y	Y
Last Name (Surname)	`LastName`	Text	Yes	—	Y	Y	Y
New Location City	`NewCity`	Text	Yes	—	Y	Y	Y
New Desk Location	`DeskLocation`	Text	—	—			Y
Needs Building Access Card	`NeedsCard`	Checkbox	—	—			Y

Rate/Position Change Notification¶

rate-position-change-notification · category Human Resources · v1 · 32 fields · 3 delivery copies · retained 7 years

Col	Destination	Function	Channel	Template
D1	IT Accounts `81`	IT	HappyFox ticket queue	IT Position Change Template
D2	HR / People Team `92`	HR	HappyFox ticket queue	HR Position Change Template
D3	Finance `96`	FIN	HappyFox ticket queue	IT Position Change Template

Field	Key	Type	Req	Sensitivity	D1	D2	D3
Personal Phone Number	`PhoneNumber`	Text	Yes	—		Y
Employee Email	`Email`	Text	Yes	—		Y
Employee Address	`Address`	Text	Yes	—		Y
Employee Name	`Name`	Text	Yes	—	Y	Y	Y
Former Job Title	`FormerTitle`	Text	Yes	—
Former Department	`FormerDepartment`	Text	Yes	—
New Department	`NewDepartment`	Text	Yes	—	Y		Y
New Position (Yes/No)	`NewPosition`	Dropdown	Yes	—		Y
New Hourly Rate	`NewHourlyRate`	Text	Yes	Compensation		Y
Management Position (Yes/No)	`Mgmtposition`	Dropdown	Yes	Employment terms		Y
New Salary	`NewSalary`	Text	Yes	Compensation		Y
If Management , will this position have a direct report (Yes/No)	`IfMgmtposition`	Dropdown	Yes	—
New Job Title	`Title`	Text	Yes	—	Y	Y	Y
New Manager	`Manager`	Text	Yes	—	Y	Y	Y
Project Code	`ProjectCode`	Text	Yes	Cost centre		Y
New Salary Band	`SalaryBand`	Text	—	Compensation		Y
New Payroll Approval	`PayrollApproval`	Text	—	Compensation		Y
New Payroll Cost Center	`CostCenter`	Text	—	Cost centre	Y	Y	Y
Pay Scale	`PayScale`	Dropdown	Yes	Compensation		Y
Location	`Location`	Dropdown	Yes	—	Y	Y	Y
Super Department	`SuperDepartment`	Dropdown	Yes	—		Y
Bargain Type (In/Out)	`BargainType`	Dropdown	Yes	Employment terms		Y
EEO1	`EEO1`	Dropdown	Yes	EEO / protected class		Y
Laptop Required	`LaptopRequired`	Dropdown	—	—	Y		Y
Effective Date	`Date`	Date	—	—	Y	Y	Y
Laptop Type	`LaptopType`	Dropdown	—	—	Y	Y	Y
DOL Status	`DOLStatus`	Dropdown	Yes	—	Y	Y	Y
Email Change	`EmailChange`	Dropdown	—	—	Y		Y
Notes	`Notes`	Long text	Yes	—		Y
Exempt Type	`ExemptStatus`	Dropdown	Yes	Employment terms		Y
Greenpeace Inc %	`GPInc`	Number	—	Grant funding		Y
Greenpeace Fund %	`GPFund`	Number	—	Grant funding		Y

3 of 32 fields on this form reach no destination.

5. Findings and the decisions requested¶

F0 — No cross-department leak into any IT destination ✅¶

Across all 36 delivery legs in this scope, zero HR-scoped fields render in a copy addressed to IT. Salary, Pay Scale, EEO1, Bargain Type, Insurance, PTO, grant percentages and HR Termination Codes appear only in HR-addressed copies. Zero personal mailboxes remain on any IT leg (commit 3015628 holding).

75 distinct sensitive-or-classified fields do reach an IT destination, but they break down as 70 general-sensitive (operational identity and contact data IT needs to act), 3 cost-centre and 2 personal-contact. No HR-scoped class among them. No decision required — recorded so the next run does not re-raise it.

F1 — IT Accounts receives home address and personal phone on New Employee ⚠️¶

Decision requested. Mailing Address and Personal Phone Number render in all six copies of New Employee, including both IT Accounts copies. The same routing to the Data Requests queue was confirmed intentional by the data owner (master audit §5.2), but it has never been separately confirmed for IT. IT does not need a home address to create an account.

F2 — IT, Data and Finance receive the departee's shipping address on termination ⚠️¶

Decision requested. Address, City/State and Contact Phone render in the IT Termination Template (D2/D3/D4/D7). Defensible — IT ships the laptop back — but note that Facilities, who arguably do the shipping, is the one destination that does not get it.

F3 — 16 fields across this scope are collected but sent to nobody ⚠️¶

Decision requested. They are still encrypted and retained seven years.

New Employee (11). Seven are IT-operational: Workstation MAC Address, Telephone Extension, Jack Number, the three business-card include flags, and Sharing Greenpeace Computer?. IT is the only plausible consumer and IT receives none of them. This is the sharpest finding on the form.
Rate/Position Change (3). Former Job Title, Former Department and If Management, will this position have a direct report — all three are required, so the submitter is forced to answer and no team ever sees it.
IT Support Request (1). Laptop/Projector Request — see §6.2.
DHCP Request (1). Attachment — see F6.

F4 — Data Restoration Request delivers to an empty address ⚠️¶

Decision requested. All five fields render into an email whose destination is the empty string. The form is live and accepting submissions; every submission is stored, encrypted, retained seven years and delivered to nobody. This is the only one of the five empty-destination forms in the master audit that IT owns, so IT is the owner who must set the destination. Likely gpus-it-support@greenpeace.org.

F5 — IT Accounts receives two differing New Employee notices ⚠️¶

Decision requested — and this one is a trap. D2 (IT New Employee Template) and D3 (General New Employee Template) both go to gpus-it-accounts@ from a single submission, and they are not the same content:

Only in D2 (IT template)	Only in D3 (General template)
`Preferred Name`, `Department`, `Notes for IT`, `Laptop Type`	`Personal E-mail Address`, `Check if Employee will use Phone`

Retiring either copy loses fields unless the survivor is merged first. Recommend merge-then-drop, not drop.

F6 — DHCP attachments are uploaded but never mentioned to IT Support ⚠️¶

Decision requested. The DHCP Request Template references no attachment. Live database: 6 of 9 DHCP submissions carry an attachment row, including two of the three most recent. The file is stored in GCS and ClamAV-scanned, but the email IT Support receives contains no link and no indication a file exists — IT has to know to go and look in the portal.

F7 — `gpus-it-infrastructure@` was mis-bucketed as an individual ✅¶

Fixed 2026-08-04 in build_audit.py (v1.1). The address was absent from EMAIL_OWNERS, so the sole destination of Frontline Form Request fell through to the individual bucket — reading as a personal mailbox and dropping the form out of the delivery-scoped IT review. The routing was always correct; only the report was wrong, so the portal-wide "zero personal mailboxes" result stands.

Same class of defect as the #85 queue mis-attribution already recorded in governance/scripts/README.md: infer a destination and you will eventually infer it wrong. The fix changes this page and the next issue — the 2026-08-03 .docx copies are deliberately not regenerated, since they are the record of what was actually sent to each owner.

F8 — Live-DB-vs-repo drift: none ✅¶

Recorded explicitly so the reviewer knows it was checked rather than assumed. See §2.

6. Two IT-specific items¶

6.1 `RemoveFromKace` renders as `[RemoveFromKace: —]`¶

Confirmed, and the mechanism is understood. The field is on DHCP Request, and the DHCP Request Template does render it (Remove from KACE? {{ RemoveFromKace }}), so it reaches IT Support.

On submission 0b3acc01 (2026-07-29) the live database holds five field rows — DHCPEntryType, MACAddress, Notes, User, WifiMACAddress. There is no RemoveFromKace row at all. The chain, verified in code:

FieldRenderer.tsx renders a checkbox as a single hardcoded option labelled "Yes", checked={value === true}. There is no "No" and no default.
An untouched checkbox leaves values[field.id] as undefined.
FormFill.tsx:145 — if (values[f.id] !== undefined) — so an untouched checkbox is omitted from the submitted payload entirely.
routes_phase2.py:279 — value = fields_in.get(...); if value is None: continue — so no row is written.
template_render.py:98 — the template still references the key, which is now missing from the field dict, so VisibleUndefined renders the marker [RemoveFromKace: —].

Why this matters more than a cosmetic glitch. That marker was designed to mean "this template references a key the form did not supply" — a template↔form mismatch someone should fix. Here it fires on the ordinary path of a user simply not ticking a box, so IT Support cannot distinguish "KACE removal not requested" from "the form is broken." It also yields three renderings of one question: ticked → True; ticked then unticked → False; never touched → [RemoveFromKace: —].

Frequency. The row is present on the six DHCP submissions from 2026-06-12 through 2026-07-23 and absent on all three since. This is not a regression: the only candidate code change, 29fd27c, deployed 2026-07-23 13:20 UTC and two submissions after that deploy still stored the value. Three consecutive submitters left the box unticked.

Decision requested. Recommend converting RemoveFromKace from checkbox to a two-value pulldown (Yes/No), matching how Laptop Required is already modelled — the answer becomes explicit, storable and unambiguous. A template-only fix such as {{ RemoveFromKace | default("No") }} would silence the marker but still record nothing, leaving the audit trail blank.

6.2 The laptop gap — partly closed, two holes remain¶

No IT-owned form captures laptop provisioning. All laptop data is collected on HR-owned forms. Live state:

Form	Field	Req	Who receives it
New Employee	`LaptopType`	Yes	IT Accounts (D2 only)
New Employee	`NeedsWorkstation` ("Computer Employee will use")	—	IT Accounts (D2+D3), Facilities, Finance, Data
New Employee	(no `LaptopRequired` field exists)
Rate/Position Change	`LaptopRequired`	—	IT Accounts, Finance
Rate/Position Change	`LaptopType`	—	IT Accounts, HR, Finance
IT Support Request	`Equipment` ("Laptop/Projector Request")	—	nobody
Laptop Retrieval	(retrieval only — no type or spec fields)

Taylor's ask is now satisfied on both lifecycle forms. On Rate/Position Change, LaptopRequired and LaptopType reach IT Accounts as of commit 89ebf11; both placeholders were confirmed live in the production template on 2026-08-04. On New Employee, LaptopType already reached IT Accounts. The HR audit's statement that "IT never learns about the laptop" is no longer true as of 2026-08-03 — noted here so no decision is taken against stale facts.

Two holes remain, both IT's to decide:

Laptop/Projector Request on IT Support Request routes to nobody. This is the only laptop field on an IT-owned form, and the template does not reference it. Someone ticking it on IT's own support form generates a ticket with no indication they asked for hardware. It is also a single-option checkbox, so it carries the identical [—] defect as RemoveFromKace. Highest-value one-line fix in this audit.
LaptopType on New Employee lives only in the D2 copy — one of the two duplicate IT Accounts notices in F5. Retiring the wrong copy silently loses the laptop type. Please make the F5 decision merge-first.

Also worth noting: New Employee has no Laptop Required field at all. The "is a laptop needed" signal is encoded implicitly across LaptopType (required; Macintosh / Windows PC / Chromebook / TBD / NA) and NeedsWorkstation (None / Desktop / Laptop / Has Own), which is why New Employee and Rate/Position Change disagree in shape.

7. Returning this review¶

Fill in the Decision column in §4 with keep, remove or change, and resolve the eight flagged items in §5 (F1, F2, F3, F4, F5, F6, and both items in §6). Return the page or a diff against it.

Changes are applied to IT's templates only — a field removed from an IT copy still renders in the HR copy of the same form, because each destination renders its own template. Two exceptions worth knowing before deciding:

Rate/Position Change — IT Accounts and Finance share the IT Position Change Template, so an edit there lands on Finance too.
Employee Termination — IT Accounts, Data Requests, Finance and the Data Team all share the IT Termination Template.

Re-run the audit after any change: a merged routing edit is live at the next deploy, not at a later approval step.

governance/forms-field-audit.md — the master control and portal-wide findings; §7.1 tracks departmental review status.
governance/reviews/README.md — the per-owner review copies issued on 2026-08-03 and their scope basis.
governance/scripts/README.md — how to re-run the audit end to end.
architecture/forms-phase2.5c-design.md — the per-action routing model.