Public surfaces — policies, meetings, declarations

For admins

Public surfaces

Schools and trusts have statutory obligations to publish certain governance information. Keystone exposes three public, unauthenticated surfaces:

/policies — published policies.
/governance/meetings — approved minutes.
/governance/declarations — published declarations of interest.

These are usually linked from the trust website with text like “Trust governance information” or “Statutory information”. Parents, governors, Ofsted inspectors, and ICO investigators can read them without an account.

What appears

Each surface has its own gating:

Policies — is_public && status='published'. The current version’s body is rendered; older versions are not exposed.
Meetings — is_published && status='approved'. The public summary, non-confidential papers, and non-confidential decisions only. The minutes body is not rendered — you publish the summary you wrote, not the full minutes.
Declarations — is_active && is_published. The public summary is preferred over the description; if you didn’t write a summary, the description shows.

The server-side filter means a misconfiguration (e.g. someone leaves is_published = false) hides the row entirely — there’s no “preview” leak for unpublished items.

What’s never published

Admin metadata: clerk names, approver names, audit timestamps, internal categorisation.
Confidential meeting papers and decisions, flagged at upload time.
Sensitive declaration descriptions if the operator chose to write a sanitised summary instead.
Anything in the database that doesn’t pass the gating flags above.

Rate limiting

All three surfaces are rate-limited at the route layer. Excessive crawling triggers throttling. This is to discourage casual scraping — it’s not a security control (the data is public by intent), it’s a politeness one.

Operating the surfaces

Confidential flag at upload time is the only protection against accidentally publishing a sensitive paper. Train clerks to default to confidential and only flag public when explicitly cleared.
Public summary for declarations is your sanitised version. “Spouse employed by trust supplier” > “PSC of Acme Holdings Ltd, T/A Acme IT Solutions”.
Slug on policies needs to be set for the public URL to work. Slug kebab-case, lowercase, no spaces.

Gotchas

Removing is_public from a previously-published policy hides it but doesn’t 410. The public URL returns 404 — clean from your search-engine submission so it isn’t crawled back.
Approving a meeting requires the workflow to be followed: scheduled → in_progress → concluded → minuted → approved. The public surface only sees the final approved state.
The public surfaces are workspace-scoped — multi-tenant installs render each workspace’s data under a workspace prefix. Single-tenant installs render directly at the paths above (/policies, /governance/meetings, /governance/declarations).