# Recording Security and Privileges

Recordings are sensitive tenant-scoped media. MarvelPBX authorizes metadata and bytes independently and fails closed.

## Capabilities

- `recording.list`
- `recording.view_metadata`
- `recording.play`
- `recording.download`
- `recording.export`
- `recording.upload`
- `recording.delete`
- `recording.admin`
- `recording.ai_read`

Existing Vtiger module and PBXManager record read permission maps only to list, metadata and play. Download, export, upload, delete, admin and AI access require explicit adapter grants. Vtiger Administrator status is not implicitly equivalent to every recording capability. `recording.admin` does not imply delete. The current package is single-tenant and uses a fixed local tenant scope; a reviewed tenant adapter is required before multi-tenant deployment.

## Transport and storage boundary

The browser supplies only an internal PBXManager record ID and requested `play` or `download` disposition. It cannot supply UCM host, filename, directory, URL, sourceuuid or path. Server-side resolution validates the exact CDR relationship and authenticated REC listing before streaming bounded WAV bytes.

Credentials and session cookies remain inside the UCM adapter. HTTPS verification is enabled by default. Any temporary DEV `verify_tls=false` setting remains an explicit warning-bearing exception and is not a production default. Redirects, traversal, arbitrary local reads, unrestricted listings and client-supplied paths are rejected.

## Audit

Playback and download grants/denials write append-only restrictive JSONL with tenant, actor ID, safe recording ID, action, result, reason and timestamp. Audit excludes caller/contact data, source UUID, physical path, raw filename, API result, credentials, cookies and recording bytes. Upload/export/reassociation/delete events must use the same minimized model when those write-side workflows are implemented.

## Retention and deletion

Physical deletion remains disabled. A later reviewed lifecycle must separately define retention, legal hold, archive verification, purge authorization and deletion audit. AI identities can never delete source recordings.

## AI boundary

`recording.ai_read` is separate from human download. A future AI job receives an opaque recording reference or short-lived controlled media stream tied to tenant, job and expiry. It never receives UCM/NAS credentials, AMI access or storage topology. Access must be revocable and audited. Phase 9R1 makes no external AI request.