# PolicyFieldRule

## Description

PolicyFieldRule defines how a specific field is handled during audit capture for a parent AuditPolicy. Each rule specifies a fieldName and a sensitivityMode that controls how the field's value is stored in ChangeDetail records. Sensitivity modes include CAPTURE (store raw value, default), MASK (store masked representation), HASH (store one-way hash), and EXCLUDE (record that the field changed but store null for both values). Field names must be a subset of the target entity's registered auditableFields.

Examples: "socialSecurityNumber with EXCLUDE mode", "salary with MASK mode", "amount with CAPTURE mode (default)".

## Domain Model Definitions

### Model type

Standard

### Command Definitions

- [createAuditPolicy](../commands/CreateAuditPolicy.md) - PolicyFieldRules are created as part of audit policy creation
- [updateAuditPolicy](../commands/UpdateAuditPolicy.md) - PolicyFieldRules are modified as part of audit policy updates

### Query Definitions

- [getAuditPolicy](../queries/GetAuditPolicy.md) - PolicyFieldRules are returned as part of audit policy retrieval
- [listAuditPolicies](../queries/ListAuditPolicies.md) - PolicyFieldRules are returned as part of audit policy listing

### Models

- PolicyFieldRule

### Invariants

- Each PolicyFieldRule belongs to exactly one AuditPolicy via auditPolicyId
- fieldName is required and must be non-empty
- fieldName must be a member of the target entity's registered auditableFields
- Duplicate fieldNames within the same AuditPolicy are rejected
- sensitivityMode must be one of CAPTURE, MASK, HASH, or EXCLUDE; defaults to CAPTURE if not specified
- When sensitivityMode is MASK, the stored value replaces all but the last 4 characters with asterisks (or stores "***" if the value is 4 characters or fewer)
- When sensitivityMode is HASH, the stored value is a one-way hash of the original value
- When sensitivityMode is EXCLUDE, ChangeDetail records store null for both oldValue and newValue
- Sensitivity modes are enforced at write time — once an audit entry is persisted, the original raw value cannot be recovered from MASK, HASH, or EXCLUDE entries
- Binary / BLOB fields are not eligible for policy field rules and cannot be added as a fieldName

### Relationships

- **Belongs To AuditPolicy**: Each PolicyFieldRule is linked to exactly one AuditPolicy via auditPolicyId
- **Validated Against AuditableEntity**: fieldName must be a member of the target entity's registered auditableFields
