mirror of
https://github.com/magnus919/agent-skills.git
synced 2026-09-21 16:46:26 +03:00
Magnus HedemarkGitHubusername <username>factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>Add privacy-engineering skill that translates privacy principles and legal requirements into verifiable engineering artifacts: data-lifecycle records, privacy acceptance criteria, data-flow and access maps, retention/deletion verification plans, and privacy change reviews. Covers seven privacy dimensions (purpose, lifecycle/retention, access, deletion, tenant/isolation, residency, consent) as structured concerns. Addresses agent traces (LLM conversation logs, tool-call history) and product analytics telemetry with privacy-specific guidance. Routes legal interpretation to legal-strategy and security implementation to secure-software-engineering. Includes: - SKILL.md with Loading Guide, file map, and routing boundaries - README.md with 5 required sections - references/discovery-brief.md comparing 10 adjacent skills - 5 templates for expected artifacts - evals/evals.json with 6 cases covering all mandatory scenarios - Updated root README catalog, skill-triggers, and generated catalogs Co-authored-by: username <username> Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
69 lines
1.8 KiB
Markdown
69 lines
1.8 KiB
Markdown
# Data-Flow and Access Map
|
|
|
|
Template for mapping data flows across services, tenants, and geographic regions. Documents where data transits, where it resides, who can access it, and under what conditions.
|
|
|
|
## System boundary
|
|
|
|
| Field | Value |
|
|
|---|---|
|
|
| **System / feature** | |
|
|
| **Data categories mapped** | |
|
|
| **Trust boundaries crossed** | |
|
|
| **Owner** | |
|
|
| **Last updated** | |
|
|
|
|
## Service-level data flow
|
|
|
|
For each service that touches the data categories in scope:
|
|
|
|
| Service | Data received | Data stored | Data transmitted | Transmission destination | Transmission purpose |
|
|
|---|---|---|---|---|---|
|
|
| | | | | | |
|
|
| | | | | | |
|
|
|
|
## Cross-region data flow
|
|
|
|
| Data category | Source region | Destination region | Transfer mechanism | Legal basis for transfer | Encryption in transit |
|
|
|---|---|---|---|---|---|
|
|
| | | | | | |
|
|
| | | | | | |
|
|
|
|
## Access matrix
|
|
|
|
| Data category | Actor (user, service, role) | Access type (read, write, delete) | Access condition | Access logged? | Log retention |
|
|
|---|---|---|---|---|---|
|
|
| | | | | | |
|
|
| | | | | | |
|
|
|
|
## Tenant isolation
|
|
|
|
| Tenant boundary | Isolation mechanism | Cross-tenant query prevention | Verified? | Verification method |
|
|
|---|---|---|---|---|
|
|
| | | | | |
|
|
|
|
## Third-party and subprocessor flows
|
|
|
|
| Third party | Data shared | Purpose | DPA in place? | Data residency | Deletion commitment |
|
|
|---|---|---|---|---|---|
|
|
| | | | | | |
|
|
|
|
## Data stores inventory
|
|
|
|
| Store type | Data categories stored | Region | Encryption at rest | Backup region | Backup retention |
|
|
|---|---|---|---|---|---|
|
|
| Primary database | | | | | |
|
|
| Cache | | | | | |
|
|
| Read replica | | | | | |
|
|
| Object storage | | | | | |
|
|
| Search index | | | | | |
|
|
| Message queue | | | | | |
|
|
| Log store | | | | | |
|
|
| Analytics warehouse | | | | | |
|
|
| Archive | | | | | |
|
|
|
|
## Gaps and follow-up
|
|
|
|
| Gap | Severity | Owner | Due date |
|
|
|---|---|---|---|
|
|
| | | | |
|