privacy-disclosure

PRIVACY_DISCLOSURE Skill (DAML)

Trigger Pattern: Always required for DAML audits Inject Into: Breadth agents, depth-edge-case Finding prefix: [DML-PD-N] Rules referenced: R10, R13

DAML enforces sub-transaction privacy: a contract is visible only to its stakeholders (signatories + observers), plus parties to whom it is divulged (incidentally disclosed when they participate in a transaction that fetches it). An over-broad observer, divulgence through a shared transaction, or an interface view that exposes too much, all leak confidential state to parties who should not see it. STRICT GATE: a privacy finding is reportable ONLY with a party-scoped query@T outsider PoC steer that returns a non-empty result for a party who should see nothing. Disclosure-design prose without a query@T steer is NOT a finding — drop it.

1. Stakeholder-Set Inventory

For every template, enumerate exactly who can see each instance:

Template	Signatories	Observers	Observer Source	Confidential Fields	Over-Broad?
{T}	{parties}	{parties}	fixed / arg.X / list field	{amount, counterparty, terms}	[DML-PD-N] if observer sees secrets

Critical patterns to flag:

• An observer set derived from a choice argument or a caller-supplied list → a party can add themselves as an observer of a contract carrying confidential terms ([ELEVATE:OBSERVER_BROAD]).
• An observer added "for convenience" (e.g., a market operator) who thereby sees per-party amounts/positions that should remain bilateral.

DAML note: controller p auto-adds p as an observer for the duration the choice is exercisable. A nonconsuming choice with a broad controller persistently discloses the contract to all those parties.

2. Divulgence-via-Fetch

Divulgence is incidental: when party X participates in a transaction that fetches contract C, X learns C's contents even if X is not a stakeholder of C.