naftiko: 1.0.0-alpha2
info:
  title: Gdpr Governance Capability
  description: A governance capability that enforces GDPR data-subject rights (access, erasure, portability) on top of any consumer API.
  tags: [Naftiko, GDPR, Privacy]
  created: '2026-05-01'
  modified: '2026-05-04'
binds:
- namespace: onetrust-env
  keys: {ONETRUST_HOST: ONETRUST_HOST, ONETRUST_TOKEN: ONETRUST_TOKEN}
capability:
  consumes:
  - namespace: onetrust
    type: http
    baseUri: https://{{ONETRUST_HOST}}
    authentication: {type: bearer, token: '{{ONETRUST_TOKEN}}'}
    resources:
    - {name: dsr-requests, path: /api/datasubject/v3/requests, operations: [{name: create-dsr-request, method: POST}, {name: list-dsr-requests, method: GET}]}
    - name: dsr-request
      path: /api/datasubject/v3/requests/{{request_id}}
      operations:
      - {name: get-dsr-request, method: GET, inputParameters: [{name: request_id, in: path}]}
  exposes:
  - type: rest
    address: 0.0.0.0
    port: 8080
    namespace: gdpr-governance-capability-rest
    description: REST surface for GDPR DSR requests.
    resources:
    - {name: dsr, path: /dsr, operations: [{method: POST, name: create-dsr, call: onetrust.create-dsr-request}]}
  - type: mcp
    address: 0.0.0.0
    port: 3010
    namespace: gdpr-governance-capability-mcp
    description: MCP for GDPR DSR.
    tools:
    - {name: create-dsr, call: onetrust.create-dsr-request}
    - {name: list-dsr, hints: {readOnly: true}, call: onetrust.list-dsr-requests}
    - name: get-dsr
      hints: {readOnly: true}
      inputParameters: [{name: request_id, type: string, required: true}]
      call: onetrust.get-dsr-request
  - type: skill
    address: 0.0.0.0
    port: 3011
    namespace: gdpr-governance-capability-skills
    description: Skill for GDPR governance.
    skills:
    - name: gdpr-governance-capability
      description: GDPR data-subject-rights governance.
      location: file:///opt/naftiko/skills/gdpr-governance-capability
      allowed-tools: create-dsr,list-dsr,get-dsr
      tools:
      - {name: create-dsr, from: {sourceNamespace: gdpr-governance-capability-mcp, action: create-dsr}}
      - {name: list-dsr, from: {sourceNamespace: gdpr-governance-capability-mcp, action: list-dsr}}
      - {name: get-dsr, from: {sourceNamespace: gdpr-governance-capability-mcp, action: get-dsr}}