Release note · August 4, 2026

A future-save privacy request is a review boundary

A Word document can store a request that a capable host remove authors’ personal information on a later save. That request matters in review, but it is not proof that the current package contains no personal information, that a client will act on it, or that a particular definition of “personal information” applies.

DocFence 0.32 adds a private-by-default inventory for direct w:removePersonalInformation Settings leaves. It gives CI a narrow, reviewable signal for the stored request without identifying an author, inspecting document properties, removing data, saving a document, or opening a document client.

One direct leaf, one future-save request

Microsoft documents RemovePersonalInformation as a Settings property: when enabled, hosting applications shall remove personal information of document authors when saving. The same contract leaves the definition and extent of that information undefined. DocFence therefore records only the direct stored state.

word/settings.xml
  w:removePersonalInformation w:val="true"   stored request for a later save

The scanner records this leaf. It does not inspect or alter the package.

DocFence accepts one strict CT_OnOff leaf per discovered Settings part in Transitional and Strict Word namespaces. An omitted w:val is enabled; supported enabled and disabled spellings normalize together. Duplicate, malformed, or ambiguous leaves are rejected rather than guessed about.

The implementation reads stored package bytes only. It never opens or saves Word, identifies authors, parses document-property values for personal information, rewrites properties, removes comments or revisions, follows a relationship, evaluates a field, runs a macro, or claims a host will honor the request.

Aggregate evidence, intentionally modest policies

Public JSON, Markdown, and SARIF expose only personal_information_removal_on_save_enabled_setting_count and personal_information_removal_on_save_disabled_setting_count. Settings paths, raw XML, and private semantic fingerprints remain local. Equivalent enabled spellings stay quiet at the inventory layer; an enabled/disabled transition does not.

rules:
  require_personal_information_removal_on_save: true

The candidate-state gate emits DFP077 only when no enabled stored request is present. It is a positive future-save intent gate, not a current-package cleanliness test. A team that intentionally approves a particular stored state can instead protect a baseline:

rules:
  no_personal_information_removal_on_save_changes: true

DFP078 flags a material inventory change. Neither rule asserts that a client will remove data, so a review policy stays readable about what it does—and does not—establish.

Evidence without privacy theater

The release regression suite covers absent, implicit, enabled, disabled, and Strict forms; malformed-leaf rejection; equivalent-spelling stability; privacy redaction; policy behavior; and JSON, Markdown, and SARIF output. Hosted CI passed on the release commit, reproducible wheel and source-archive builds passed metadata checks, and downloaded public artifacts matched their published SHA-256 digests.

Document Change Assurance Benchmark 0.22.0 supplies the matching deterministic pair. It changes only w:removePersonalInformation from explicit false to true; package members and stored text stay fixed, and the optional adapter reaches a strict 33/33 score from public aggregate evidence only.

python -m pip install https://github.com/SybilGambleyyu/docfence/releases/download/v0.32.0/docfence-0.32.0-py3-none-any.whl

docfence profile candidate.docx --format markdown
docfence check approved.docx candidate.docx --policy docfence.yml --format sarif --output docfence.sarif

The public release includes the wheel and source archive. The tagged policy reference, threat model, and validation notes define the evidence contract and its limits.