# Provider person-import mapping and decision log

**Applies to:** Hermes Adelphi and Keystone Online discovery only.  
**Status:** draft; not signed off. No import is permitted.

| External field | Internal field | Ownership | Rule |
| --- | --- | --- | --- |
| external_person_id | external_person_id | Source-controlled | Required stable identity; stored with scoped source_system. |
| source_system | source_system | Source-controlled | Required provider key; never inferred from a display name. |
| first_name, surname, salutation | matching people fields | Reviewed | Staged import and duplicate review required. |
| email, phone | matching people fields | Reviewed | Explicit contact-consent evidence remains required. |
| membership_type, membership_state | staged membership fields | Reviewed | Requires Unit/Province scope validation. |
| unit_external_id, province_external_id | scoped link resolution | Reviewed | Resolve only against authorised Unit/Province links. |
| order_key | order_key | Reviewed | Resolve through the central terminology/order catalogue; never create an Order. |
| local_person_id | person_id | Locally controlled | Never overwritten by a provider. |
| welfare, health, finance, passwords, MFA, documents, sensitive family data | none | Never imported | Reject mapping and payload. |

## Decision gates

1. Obtain vendor documentation and controller approval.
2. Record permitted fields, identifiers, deltas, deletion handling, rate limits and support contact in the provider profile.
3. Validate the fixture mapping.
4. Create an immutable decision-log version and have an authorised data owner sign it off.
5. Only then may a separate, explicitly approved import implementation be proposed.

No data is imported, updated, deleted, or transmitted by this discovery implementation.