# EM-LEG-06 provider comparison

Claude and Grok agree on the primary boundary: Processing Activity needs an independent, identifier-unassigned identity; Data Subject Request is a WM-ACT-021 profile; Purpose and Processing Basis are separate attributable assertions; Retention Rule is expressed through WM-KNW-012 and WM-XCT-029; ROPA is a read-only projection; consent withdrawal is prospective and basis-scoped; erasure is determined per location; deletion proof contains a tombstone and non-reversible digest without payload.

The reconciled proposal adopts Grok's stricter purpose rule. A derived dataset or WM-XCT-003 projection may only preserve or narrow its source purpose ceiling. A wider analytics purpose requires a separately governed Processing Activity with its own Purpose and Processing Basis rather than a compatibility-assessment widening inside the old activity.

Per-location determination belongs to the WM-ACT-021 request profile. The Processing Activity supplies the accountability subject and location bindings, while the request case records determinations, execution, evidence, propagation and refusal grounds. Case closure does not imply that every location has erased data and does not retire the activity.

The proposed candidate remains unallocated. The audit must test location ownership, distinct statutory-retention versus legal-hold triggers, multi-basis conflicts, cascade ownership, tombstone handoff, and removal of unsupported references.