Privacy review queue

The queue at /privacy/review contains two kinds of decisions:

• Drift: a declared processing/vendor relationship diverges from current grant or connector evidence.
• Connector proposals: Noru found an observed application/category overlap and proposes adding the application/vendor as a recipient on a processing activity.

This queue is different from AI field drafts, which are reviewed on the RoPA record itself.

How to review an item

1. Open the processing record and the connected-app grant; open the vendor when one exists.
2. Verify identity, scopes, observed timing, data categories, and the connector that produced the signal.
3. Decide whether the declaration is wrong, the observed access is wrong/obsolete, or both are legitimate but need a documented explanation.
4. Update the source record, grant, vendor registration, or RoPA relationship.
5. Let the next sync close a resolved divergence automatically.

For a proposal, Accept adds the proposed relationship; Dismiss is permanent and prevents the same proposal from being raised again. Confidence bands describe signal strength, not probability that accepting is legally correct.

For drift, Acknowledge records that the divergence is real but keeps it open until the underlying facts converge. Dismiss records an acceptable-divergence reason and is permanent even if the divergence persists. Use dismissal only for a durable, reviewable exception.

Bulk review is efficient for one known cause, but dangerous across unrelated origins. The queue supports search, severity, origin, and drift/proposal filters so you can make coherent decisions together.