tlp-guide

name	tlp-guide
description	Use when the user asks "what TLP should this be?", applying TLP markings to a finished product, or the tradecraft pipeline calls for TLP determination before sharing. Covers TLP v2.0 (CLEAR / GREEN / AMBER / AMBER+STRICT / RED).
user-invocable	true
metadata	{"version":"1.0.0"}

Traffic Light Protocol (TLP) v2.0

Every intelligence output from this platform MUST have a TLP designation. This is enforced by platform rules and validated by hooks.

TLP Definitions

TLP:RED — Named Recipients Only

When to use: Information that would cause significant harm if shared beyond the named recipients. Sources may face risk.

• Share with: Only the named recipients, in person or via secure channels
• Do NOT share with: Anyone not explicitly named, even within the same organisation
• Examples: Active zero-day exploitation details shared to a specific CISO; source-identifying intelligence; ongoing law enforcement operation details

TLP:AMBER+STRICT — Organisation Only

When to use: Information that requires support to be effectively acted upon, limited to the recipient's organisation only.

• Share with: Members of the recipient's own organisation on a need-to-know basis
• Do NOT share with: External parties, clients, partners, or affiliated organisations
• Examples: Targeted threat intelligence specific to one organisation's infrastructure; internal investigation findings