{"version":"2.1.323","anchor":"gate-fallback-tengu-pewter-grebe-controls-allow-data-flow","canonical_anchor":"data-flow-reporting-is-built-behind-a-flag-that-defaults-off","heading":"Data flow reporting is built in, gated by tengu_pewter_grebe and an organization policy","tier":"soon","area":"Internals","scope":"both","heads_up":false,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.323\/e\/gate-fallback-tengu-pewter-grebe-controls-allow-data-flow","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.323","markdown":"### Data flow reporting is built in, gated by tengu_pewter_grebe and an organization policy\n\nSessions can keep data-flow records in transcripts and forks, gated by tengu_pewter_grebe and an allow_data_flow policy denied under HIPAA and ZDR\n\n**Unclear.** It is not known what this check controls.\n\n**What**\n\nThis release adds data flow reporting, a new kind of record Claude Code can keep in a session. The members did not trace what the records contain or where they are sent.\n\n- Gate: it works only when the switch `tengu_pewter_grebe` is true and the organization policy allows `allow_data_flow`. The switch falls back to false when the server sends no value. Nothing has been read about it.\n\n- Policy: `allow_data_flow` is a new organization policy entry labelled \"Data flow reporting\", with requirement ID HIPAA-R150. It is denied under `hipaa` and `zdr` (zero data retention), and if the policy is not cached or the check fails open, it also resolves to `deny`.\n\n- Transcript: the session file gains `data-flow-records`, `data-flow-incomplete` and `derived-from` entries. The first two add up over the session and the last one keeps only the latest value. For agents they are written at exit, a helper decides whether they are written, and the session file reader understands the \"snapshots\" kind.\n\n- Session state: the saved state now carries `dataFlowRecords`, `dataFlowOwed`, `dataFlowIncomplete` and `dataFlowDerivedFrom`.\n\n- Forks: forking a conversation copies the data-flow records, the incomplete flag and the derived-from lineage into the new session.\n\n- Tombstone removal: removing deleted entries from a session file now refuses to edit a file that ends before its reported size.\n\n**Why**\n\nSession files can now hold a new record type that follows a conversation into its forks. Organizations under HIPAA or zero data retention are denied it by policy, and nothing turns it on unless the server sends a value for its switch.\n\n- Flag `tengu_pewter_grebe`: Not enough to say (read for one account on one subscription tier against v2.1.323; this account: no value returned, anonymous baseline: no value returned, compiled default: off) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release.\n- Area: Internals\n- Tier: Nothing to try yet\n- Useful: 4\/5\n- Signal: 4\/5\n- Scope: both\n- Heads-up: no\n- Present in the build but not switched on"}