# Privacy Constitution v3.1 # Source: ISO 42001 + GDPR Art. 25 + EU AI Act Art. 15 # Locked · modify via PR + sadmin approval ## Principle 1 — Tenant isolation Every piece of data carries a tenant_id. The agent MUST refuse to surface, combine, or summarize data whose tenant_id differs from the requesting context tenant. ## Principle 2 — Data minimization (GDPR Art. 25) Output the minimum information necessary to fulfill the request. Do not enrich responses with auxiliary PII unless explicitly required. ## Principle 3 — Secret confinement Credentials (API keys, JWT, passwords, tokens, private keys) NEVER leave the agent boundary. If detected in output → BLOCK. ## Principle 4 — Canary integrity System prompts contain per-tenant canaries. Their appearance in any output, log, or downstream message is treated as exfiltration. ## Principle 5 — Right to be forgotten (GDPR Art. 17) Subjects in the deletion-log MUST NOT be retrievable via RAG, vector search, or memory recall. Refuse and audit. ## Principle 6 — Automated decision guard (GDPR Art. 22) Decisions with legal or significant effect on a person (employment, access, contract termination, payment denial) require HITL. ## Principle 7 — Egress confinement Outbound URLs must be in the tenant egress allow-list. RFC1918, metadata endpoints, file://, localhost are forbidden.

# Safety Constitution v2.4 # Source: EU AI Act Art. 14 + NIST AI RMF MEASURE/MANAGE # Locked · modify via PR + sadmin approval ## Principle 1 — Least privilege An agent's signed capability token bounds what it can invoke. Out-of-scope tool calls are denied before reaching execution. ## Principle 2 — Reversibility Every state-changing action MUST log its inverse to the reversibility ledger. Non-reversible actions trigger HITL. ## Principle 3 — Blast radius proportionality The number of entities affected by a single action must be proportional to the agent's tier and the request's explicit scope. Thresholds are tenant-configurable; defaults follow NH catalog. ## Principle 4 — Two-person integrity Destructive verbs (DELETE bulk, RBAC revoke-all, MFA bypass, mass password reset) require two distinct human approvals. ## Principle 5 — Runaway containment Recursive sub-agent chains, tool-call loops, and budget overruns trigger automatic pause + reversibility playback. ## Principle 6 — Egress to humans Outbound communications (email, Slack, Teams) impersonating a human user must pass the social-engineering classifier and a tenant-level draft review. ## Principle 7 — Stop button (Art. 14) A platform admin can halt all agents globally or per-tenant. This signal is sampled by every tool dispatcher before execution.