| name | risk-compliance |
| description | Use for regulated, financial, customer-facing, enterprise, or high-risk workflows that need reviewable engineering controls. Creates operational risk, privacy, security, compliance, approval, audit, copyright, hallucination, explainability, and responsibility controls. Not legal advice. |
| argument-hint | [workflow-or-domain] |
Risk and Compliance Harness
Use when
- Personal/sensitive/regulated data is involved
- Customer-facing action exists
- External model/API boundary exists
- Compliance/audit questions are likely
Do not use when
- Pure internal toy example with no risk and user asked for lightweight flow
Inputs to inspect
- Architecture
- Agent loop
- Data rules
- Feature spec
- Known policies or laws from user
Files to create or update
- Risk section in
docs/06_prd.md
- Security boundary in
docs/07_architecture.md
- Failure handling in
docs/09_flow.md
- Risk cases in
docs/10_eval-plan.md
rules/compliance-rules.md and rules/data-rules.md
Operating sequence
- Classify data types.
- Identify high-risk actions.
- Identify external model/API boundaries.
- Define approval gates.
- Define audit events.
- Define fail-closed triggers.
- Define mitigations for privacy/security/copyright/hallucination/explainability/responsibility.
- Assign owner and residual risk.
- Add limitations to handoff.
Approval Gate Schema
| Action | Risk Level | Required Reviewer | Evidence Required | Can Auto-Execute? | Audit Event |
Fail-Closed Triggers
- Missing permission.
- Missing evidence.
- Policy ambiguity.
- PII boundary uncertainty.
- Conflicting sources.
- Low confidence on high-risk action.
- External API/license uncertainty.
Quality gates
- High-risk customer action cannot be complete without approval + audit + fallback.
- Legal conclusions are not invented; uncertain law is marked for review.
Stop conditions
Stop and route backward when prerequisite artifacts are missing, when the requested action would erase user work, or when a high-risk workflow lacks evidence, approval, audit, or fail-closed handling.
Example invocation
/harness-engineering:risk-compliance
Apply this skill to the current repository. Inspect existing artifacts first, update only what is necessary, and report files changed, decisions, assumptions, validation, risks, and next skill.
Shared completion and integrity
End with the completion report in ../../references/common-completion-report.md and follow ../../references/common-integrity-rules.md.
