Step 6: Review extension risks
Extensions change the data boundary, not just the configuration.
- Conditional mappings: Define policy from data purpose and jurisdiction. Customer tier is not a substitute for that decision.
- Fan-out: Treat every raw-data branch as a separate destination with its own access, retention, and failure behavior.
- Generalization: Derive thresholds from the real population and combination of retained attributes. A static town list does not demonstrate a privacy property.
- Stable hashes: Document who can access the salts and which systems may join records over time.
The repository fixture checks the unextended core path against one exact result. Add failure cases and environment-specific controls before treating any extension as evidenced.