Feature Package PK-09 + PK-08 — Compliance, Safety & Guest Identity
Status: Package Specification
Domain: Compliance / Risk / Guest Identity
Maps to: Compliance Gates (s350), Scope Governance (s142), Record Federation (s184), Playbook H-8/H-10
External integration: Keycloak (identity), BBS+ (selective disclosure)
1. What These Packages Do
PK-09 (Compliance & Safety) gives the hotel one auditable system for health, fire, accessibility, and building-safety inspections with expert sign-off and certificate issuance. PK-08 (Guest Identity & Access) gives selective-disclosure identity verification and role-based access. Together they address regulatory compliance, insurance, and data-protection obligations.
2. Features & Functionality — Compliance & Safety (PK-09)
| Feature | What it does | Who uses it | What stands behind it |
|---|---|---|---|
| Compliance gates | Register gates for health & safety, fire safety, food hygiene, accessibility with ordered stages | Compliance officer | fn::compliance::register_gate; lookup.claims.sla.v1 |
| Inspection stages | Seven-stage building-safety chain: scheduled → fire → accessibility → hygiene → expert sign-off → certificate → packet export | Inspector, expert | building-safety-inspections.scenario.json |
| Expert sign-off | Mandatory expert sign-off (SoD: expert ≠ inspector) before certificate issues | Licensed expert | lookup.claims.sod.v1; fn::poce::record_step |
| Certificate & packet | Certificate issued; compliance packet exported (Gotenberg PDF) with evidence hashes | GM, insurer | fn::poce::finalize_session; Gotenberg export |
| Expiry watch | Certificate expiry re-schedules the next inspection | Compliance officer | SLA binding to Kestra |
| Incident escalation | Security/safety incidents escalate ladder: property desk → GM → regional safety office (human approval at each step) | Security, GM, regional office | PoCE records each escalation step; no auto-fine |
3. Features & Functionality — Guest Identity & Access (PK-08)
| Feature | What it does | Who uses it | What stands behind it |
|---|---|---|---|
| Selective-disclosure proof | Guest proves age/nationality without surrendering full ID document | Front desk, security | BBS+ credential (s121-s123) |
| Keycloak anchoring | Guest/staff identity anchored to Keycloak realm and DID | IT, security | cns://truth/node/person; Keycloak OIDC |
| Role-based access | APF resolves what a principal may do in a property scope | Department heads, IT | fn::app_perms::resolve_effective |
| Access audit | Every access grant and identity proof logged to PoCE | Compliance officer, auditor | PoCE receipt; security audit log (s146) |
4. Guard Rails
- Expert sign-off mandatory for certificates; no auto-certify
- No auto-fine; human approval at each escalation step
- Bands and thresholds are data (KV lookups); resolver never defaults — missing band refuses
- No PHI/system-of-record for medical clinics (non-goal)
- No FedRAMP High / FIPS-validated crypto (target non-federal, non-PHI paths)
5. Evidence & Audit
- Inspection records, expert sign-offs, certificates, packet exports, PoCE receipts, access-grant logs
- Verifiable offline by regulators, insurers, and data-protection auditors