# Security and personal-data SOP

Use for security/privacy questions, unexpected sensitive content or a proposed
sensitive workflow. Mandatory AGENTS.md rules apply even when this file is not loaded.

1. Establish the authorized task, data owner, purpose, lawful basis, audience and
   minimum necessary fields before access. If any are unclear, stop and ask.
2. Use only approved sources/tools. Never retrieve credentials or copy raw personal
   data into prompts, chats, logs, attachments, R2 memory or repository artifacts.
   Do not collect first and hope an output filter will fix it later.
3. Prefer aggregate/synthetic evidence. For an authorized disclosure, mask an email
   local part (j***@example.com) and retain at most four phone/ID characters
   (******1234). Redact names, addresses, birth dates and unsafe contextual identifiers.
   Masked values remain personal data; combinations can re-identify people.
4. Withhold credentials entirely, including partial/encoded forms. Unknown values
   and source content may bypass automated detection. Refuse uncertain disclosures.
5. On exposure: stop further access/delivery; notify the operator with a non-sensitive
   reference, affected system category and safe next action. Do not reproduce the
   payload. Request revocation/containment by the authorized owner when warranted.
6. Route access/deletion requests, retention, consent, international transfers
   (including model providers) and breach obligations to the privacy owner and
   approved organizational process. Do not invent deadlines or certify compliance.

Current limitation: Discord caller allowlisting is deferred. Channel participants
are not automatically authorized for sensitive data. Automated bridge masking is
deployment-dependent defense in depth, not a basis for relaxing access controls.