# Step 4 — Implementation Detail

1. Filter publication batches to matching tenant and ACL tenant identifiers.
2. Reject deleted documents from normal upsert publication.
3. Return published/rejected counts with tenant and timestamp context.
4. Provide tenant-scoped deletion helper for tombstones and retention workflows.
5. Provide structured audit-event creation without secrets or content.
6. Validate provenance, content hashes, and cross-tenant documents.
7. Document managed secrets, audit retention, source deletion, and downstream ACL enforcement.