| name | compliance-audit |
| description | Generic compliance audit context. Load before any task touching verification tiers, regulated forms, document uploads, identity verification, or anything involving user identity. Also load before any task that might accidentally reintroduce payment processing or regulated contract functionality.
|
| allowed-tools | Read, Grep |
Compliance Audit Context
Hard deleted — never recreate
Replace these placeholders with your project's forbidden files:
[FORBIDDEN_FILE_1] — e.g. payment processing service[FORBIDDEN_FILE_2] — e.g. regulated contract page[FORBIDDEN_ROUTE_1] — e.g. /contract route- Any payment processing, escrow, deposit holding, or rent collection logic
Legal lane (what we CAN build)
Adapt these to your regulated domain:
- Identity verification flows using approved third-party OAuth
- Document upload and storage in secure, designated buckets (not general media)
- Viewing/booking scheduling, outcome tracking, analytics
- Handoff cards pointing users to licensed professionals (e.g. brokers, lawyers)
[TIER_SYSTEM] — Verification Tiers
Replace with your project's access tier structure:
[TIER_0]: Unverified — browse only[TIER_1]: Basic verified — core actions (view/chat/request)[TIER_2]: Fully verified — full access via approved identity OAuth
Identity display rules
Adapt to your jurisdiction's PII requirements:
[PII_FIELD_1] (e.g. National ID): always mask in UI — show partial format only[PII_FIELD_2] (e.g. Passport number): always mask — first 2 chars + **** + last 1[PII_FIELD_3] (e.g. OAuth token ID): always mask- KYC documents: designated secure storage bucket only — never general media bucket
Compliance checklist — run before every task
After every edit
Run: npx tsc --noEmit (or equivalent for your stack)
Zero type errors required before considering task complete.
Domain-specific notes
Replace this section with your project's regulated domain rules:
Example: Property rental platform
- Max legal occupancy = number of bedrooms (one person each)
- Free-text rejection reasons are prohibited (anti-discrimination)
- Shared-bedroom listings are prohibited
- Permit/license number required on every listing before publish
Example: Healthcare platform
- Patient data must not appear in client-side logs
- Appointment data must be HIPAA/GDPR compliant
- Provider credentials must be verified before listings go live
Example: Financial services
- No unlicensed investment advice in generated content
- All monetary figures must include appropriate disclaimers
- User funds must never be held by the platform
