Pseudonymize embedded references, not just object keys

Pseudonymizing a private evidence object's key does not pseudonymize its body. A copied media URL or storage path may embed the raw subject or call identifier even when the surrounding record uses keyed hashes. Inspect every joined reference before persisting it; store a keyed reference digest and perform any dereference through a separately authorized source lookup. The trade-off is that the evidence object alone no longer resolves the media, so the join procedure must be documented and tested. This is a privacy boundary, not proof that the original media URL was private.

Applies when: diagnostic artifacts join to existing recordings or external objects. Keywords: privacy pseudonymization storage URL embedded identifier evidence sidecar HMAC