data-handling-template

# Data Handling Plan Generator The data handling plan defines **what evidence the agent collects, where it lives, how long it's kept, and who can read it**. Replaces the deprecated free-form `RoE.data_handling` string with structured per-class fields. ## When to Use - After RoE is written (RoE constraints + scope drive which data classes appear) - User says "create data handling", "retention policy", "evidence storage", "PII handling", "compliance" ## Workflow ### Step 1: Start From the Schema Defaults The `DataHandlingPlan` schema seeds four default classes — credentials, pii, source-code, business-data — with conservative retention. **Keep these by default**; override only when the engagement requires stricter or looser rules. ### Step 2: Add Engagement-Specific Classes Based on the interview: | Engagement type | Likely additional classes | |---|---| | Healthcare client | `health-records` (classification: secret, retention: 7 days, framework: HIPAA) | | Financial client | `cardholder-data` (classification: secret, retention: 0 days — never store, framework: PCI-DSS) | | EU client / data subjects | Mark existing `pii` with framework: GDPR; consider `personal-data-eu` for stricter handling | | Defense / classified | `controlled-unclassified` (classification: secret, retention: 0 days off-network) | ### Step 3: Set Evidence Storage Path Default `"/workspace/<engagement>/evidence/"` works for sandbox-isolated engagements. Override only when: - Engagement requires an external-bucket destination (S3 / Azure Blob with client KMS) - Multiple engagement workspaces share an evidence repository ### Step 4: Compliance Frameworks Set `compliance_frameworks` from the interview. Common entries: GDPR, HIPAA, PCI-DSS, SOC2, NIST 800-53, FedRAMP, ISO 27001. The orchestrator (Decepticon) reads this list and refuses to start objectives that violate the matching framework's evidence-handling rules. ### Step 5: Purge Hard Cap `purge_after_days` is the GLOBAL upper bound — every artifact older than this is deleted regardless of per-class retention. Default 90 days; reduce for engagements with tighter regulatory exposure. ## Validation Checklist Before writing `plan/data-handling.json`: - [ ] At least one `data_class` is `credentials`-equivalent - [ ] Every class has `retention_days >= 0` - [ ] `purge_after_days >= max(class.retention_days)` (otherwise classes get cut short) - [ ] If `compliance_frameworks` includes HIPAA / GDPR / PCI-DSS, matching data classes exist - [ ] `chain_of_custody=True` for any engagement that may produce findings ## Anti-patterns - Setting `retention_days=0` for `credentials` without explicit operator approval — agent then can't reference creds across phases - Disabling `encryption_at_rest` for any restricted+ class — straight compliance violation - Listing HIPAA in `compliance_frameworks` without a `health-records` class — orchestrator will refuse objectives that touch PHI ## Output Write to `plan/data-handling.json` validating against `decepticon.core.schemas.DataHandlingPlan`.