compliance-audit

Files (1)

• SKILL.md

SKILL.md (first lines)

# Compliance Audit Context

## Hard deleted — never recreate
Replace these placeholders with your project's forbidden files:
- `[FORBIDDEN_FILE_1]` — e.g. payment processing service
- `[FORBIDDEN_FILE_2]` — e.g. regulated contract page
- `[FORBIDDEN_ROUTE_1]` — e.g. /contract route
- Any payment processing, escrow, deposit holding, or rent collection logic

## Legal lane (what we CAN build)
Adapt these to your regulated domain:
- Identity verification flows using approved third-party OAuth
- Document upload and storage in secure, designated buckets (not general media)
- Viewing/booking scheduling, outcome tracking, analytics
- Handoff cards pointing users to licensed professionals (e.g. brokers, lawyers)

## [TIER_SYSTEM] — Verification Tiers
Replace with your project's access tier structure:
- `[TIER_0]`: Unverified — browse only
- `[TIER_1]`: Basic verified — core actions (view/chat/request)
- `[TIER_2]`: Fully verified — full access via approved identity OAuth

## Identity display rules
Adapt to your jurisdiction's PII requirements:
- `[PII_FIELD_1]` (e.g. National ID): always mask in UI — show partial format only
- `[PII_FIELD_2]` (e.g. Passport number): always mask — first 2 chars + **** + last 1
- `[PII_FIELD_3]` (e.g. OAuth token ID): always mask
- KYC documents: designated secure storage bucket only — never general media bucket

## Compliance checklist — run before every task
- [ ] No payment processing code introduced (grep for: stripe, escrow, DirectDebit, payment_intent)
- [ ] No forbidden files recreated (grep for [FORBIDDEN_FILE_1], [FORBIDDEN_FILE_2])
- [ ] Identity fields masked at every display point
- [ ] Secure documents only in designated secure bucket (not general media bucket)
- [ ] Access-gated actions check tier before allowing
- [ ] Footer disclaimer present on every public-facing page
- [ ] Ratings/reviews comply with local law (e.g. star-only if text reviews are regulated)
- [ ] Occupancy or capacity limits enforced (never above maximum legal limit)

## After every edit
Run: npx tsc --noEmit (or equivalent for your stack)
Zero type errors required before considering task complete.

## Domain-specific notes
Replace this section with your project's regulated domain rules:

### Example: Property rental platform
- Max legal occupancy = number of bedrooms (one person each)
- Free-text rejection reasons are prohibited (anti-discrimination)
- Shared-bedroom listings are prohibited
- Permit/license number required on every listing before publish

### Example: Healthcare platform
- Patient data must not appear in client-side logs
- Appointment data must be HIPAA/GDPR compliant
- Provider credentials must be verified before listings go live

### Example: Financial services
- No unlicensed investment advice in generated content
- All monetary figures must include appropriate disclaimers
- User funds must never be held by the platform

From The13thNode/VibeCorp_PromptCEO, MIT.

More from The13thNode/VibeCorp_PromptCEO