AutoCore Legal Customer and Operator Responsibility
Separates product controls from deployment, legal, and operator responsibilities.
AutoCore provides policy storage, revision checks, publication gates, and acceptance records. The deploying organization supplies accurate identity, approved text, retention decisions, jurisdictional review, and the people authorized to publish.
Release candidate source
This article reflects the audited AutoCore source revision 7a504f6e430c16d4fcb03ebdea3cc3fb7816df60 and immutable release-candidate tag v1.0.0-rc.1 at 9edfb109f44cc80385784c694b96392cfc04e70f. Configuration and external provider behavior remain deployment-dependent.
Source boundary
| Control | Source-verified behavior |
|---|---|
| Product responsibility | Enforce revision uniqueness, published-state filtering, checksum capture, and guarded Admin mutations. |
| Operator responsibility | Confirm entity data, policy text, effective dates, locales, contact details, and publication evidence. |
| External responsibility | Obtain advice for jurisdiction, notices, retention, processor terms, and incident obligations. |
| Public examples | Use example domains and identifiers; never copy a real entity profile into documentation. |
Operational controls
Use the smallest verified control for the task. Keep provider, host, legal, and operator responsibilities separate from application behavior. When a control is not implemented or not verified, leave it disabled or mark it as a limitation.
Verification
Verify the route, relevant API or configuration state, negative path, audit/evidence result, and public effect before closing the task. Record unknown or configuration-dependent behavior as a limitation.