skills/magnus919_agent-skills

Fork 0

mirror of https://github.com/magnus919/agent-skills.git synced 2026-09-11 19:47:12 +03:00

Files

T

6f429a91b1 feat(privacy-engineering): add privacy-engineering skill (#202 ) (#225 )

Add privacy-engineering skill that translates privacy principles and legal
requirements into verifiable engineering artifacts: data-lifecycle records,
privacy acceptance criteria, data-flow and access maps, retention/deletion
verification plans, and privacy change reviews.

Covers seven privacy dimensions (purpose, lifecycle/retention, access,
deletion, tenant/isolation, residency, consent) as structured concerns.
Addresses agent traces (LLM conversation logs, tool-call history) and
product analytics telemetry with privacy-specific guidance. Routes legal
interpretation to legal-strategy and security implementation to
secure-software-engineering.

Includes:
- SKILL.md with Loading Guide, file map, and routing boundaries
- README.md with 5 required sections
- references/discovery-brief.md comparing 10 adjacent skills
- 5 templates for expected artifacts
- evals/evals.json with 6 cases covering all mandatory scenarios
- Updated root README catalog, skill-triggers, and generated catalogs

Co-authored-by: username <username>
Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>

2026-08-02 18:42:49 -04:00

3.2 KiB

Raw Permalink Blame History

Privacy Acceptance Criteria

Template for defining verifiable, testable privacy acceptance criteria. Every criterion must include a description, verification method, and pass/fail condition. "Data is handled securely" is not a verifiable criterion — use this template to make every requirement testable.

Context

Field	Value
System / feature
Data categories in scope
Privacy dimensions addressed
Regulatory / policy drivers
Owner
Last updated

Acceptance criteria

For each privacy requirement, define at least one criterion with all three fields. A criterion without a verification method is a policy statement, not an engineering artifact.

ID	Criterion description	Verification method	Pass/fail condition
PUR-01
RET-01
ACC-01
DEL-01
TEN-01
RES-01
CON-01

Example criteria (illustrative)

ID	Criterion description	Verification method	Pass/fail condition
PUR-01	Email address collected only for account recovery; not used for marketing	Schema inspection of marketing pipeline: confirm email field is not present in marketing events table	PASS: email field absent from marketing events schema. FAIL: email field present
RET-01	User session logs retained for 90 days from session end, then deleted	Automated audit: query session_logs for records with session_end > 90 days ago; expect zero rows	PASS: zero rows returned. FAIL: any rows returned
ACC-01	Customer support staff can view user PII only while a support ticket is open	Access-log review: sample 100 access events; confirm each access corresponds to an open ticket for that user	PASS: 100/100 accesses tied to open tickets. FAIL: any access without open ticket
DEL-01	User PII deleted from primary store within 72 hours of verified account closure	End-to-end test: close test account, wait 72h, query all tables for test user PII; expect zero PII rows	PASS: no PII rows found for test user. FAIL: any PII rows remain
TEN-01	Tenant-A data never returned in a query authenticated as Tenant-B	Integration test: execute cross-tenant queries with Tenant-B credentials; verify zero Tenant-A rows in result set	PASS: zero cross-tenant rows. FAIL: any Tenant-A data in Tenant-B response
RES-01	EU user PII never stored in non-EU region	Infrastructure audit: inspect storage bucket regions, database instance regions, CDN edge locations; confirm all in EU	PASS: all stores in EU regions. FAIL: any store outside EU
CON-01	Analytics events fire only after consent is granted; no events fire post-revocation	Event-stream audit: for a post-revocation user, confirm zero events emitted after revocation timestamp	PASS: zero events post-revocation. FAIL: any event emitted after revocation

Verification schedule

Criterion ID	Verification frequency	Last verified	Next verification	Verified by

Gaps and exceptions

Criterion ID	Gap description	Exception approved by	Expiry	Mitigation

3.2 KiB Raw Permalink Blame History