content-ingestion-agent/.agents/plans/wf-decompose-b4be4be4fd0c/steps/step-4.md

Step 4 — Implementation Detail

1. Filter publication batches to matching tenant and ACL tenant identifiers.
2. Reject deleted documents from normal upsert publication.
3. Return published/rejected counts with tenant and timestamp context.
4. Provide tenant-scoped deletion helper for tombstones and retention workflows.
5. Provide structured audit-event creation without secrets or content.
6. Validate provenance, content hashes, and cross-tenant documents.
7. Document managed secrets, audit retention, source deletion, and downstream ACL enforcement.