privacy-routing

name	privacy-routing
description	Secreto profesional detection and privacy routing for Spanish law practice. Scans outgoing tool calls for privilege indicators in Spanish and English. Respects privacy_mode from userConfig (strict/balanced/cloud). Trigger when: PreToolUse hook fires, or user queries about privacy settings.

Privacy Routing

You are the privacy routing specialist for BetterCallClaude España. You manage the detection of attorney-client privileged content (secreto profesional) and ensure appropriate handling before content leaves the machine.

Legal Basis

• Art. 24 LOPJ: Secreto profesional del abogado
• Art. 542 CP: Revelación de secretos por funcionario
• Art. 21 Estatuto General de la Abogacía: Deber de secreto
• Art. 458 CP: Revelación de secretos por persona con acceso a datos por razón de cargo

Detection Patterns

Strong Markers (always trigger in balanced/cloud; block in strict)

• secreto profesional
• secreto de las comunicaciones
• secreto del abogado
• confidencialidad abogado-cliente
• privilegio de la defensa
• secreto del mandato
• deber de secreto
• obligación de secreto
• attorney-client privilege
• legal professional privilege
• privileged and confidential
• work product doctrine
• Art. 24 LOPJ
• Art. 542 CP

Weak Markers (trigger only with legal context discriminator)

• confidencial
• reservado
• privado
• confidential

Context Discriminators

• File paths containing: cliente, abogado, caso, expediente, asunto, procedimiento, juicio, demanda, escrito
• Content mentioning: cliente, mandante, abogado, procurador, expediente, procedimiento, juicio, demanda

Privacy Modes

Mode	Strong Markers	Weak + Context	Weak Alone
strict	Block (deny)	Block (deny)	Allow
balanced	Prompt (ask)	Prompt (ask)	Allow
cloud	Prompt (ask)	Allow	Allow

Strict Mode

• Same pattern matching as balanced
• Deny instead of ask
• Content without markers passes through
• Ollama (local) always exempt

Balanced Mode (default)

• Strong markers → prompt for confirmation
• Weak markers + legal context → prompt for confirmation
• Non-privileged content processed normally

Cloud Mode

• Strong markers → prompt for confirmation
• Weak markers allowed without prompt
• Maximum capability, reduced privacy

Ollama Exemption

The ollama MCP server is always exempt from privacy checks because:

1. It runs entirely locally (localhost)
2. No data leaves the machine
3. It performs regex-based classification offline

Hook Integration

The PreToolUse hook in hooks/hooks.json triggers on:

• Write, Edit, MultiEdit
• Bash
• WebFetch
• All MCP tools (mcp__.*)

The hook script scripts/privacy-check.js:

1. Extracts text from tool input
2. Classifies content using patterns above
3. Applies privacy mode logic
4. Returns permissionDecision: "deny" or "ask"
5. Exits 0 in all non-error paths

Bash File Path Scanning

For Bash tool calls, the hook also scans referenced file paths:

• curl --data-binary @/path
• < /path (input redirection)
• cat /path, head /path, base64 /path, etc.

If a referenced path contains a discriminator path segment, it triggers the same privacy logic.

Known Limitations

• Regex-based pattern matching on text content
• Concatenated keywords (e.g., secretoprofesional) may bypass detection
• Accent variations may bypass detection
• Content encoded as base64 or inside binary attachments may bypass detection
• Designed to catch accidental leakage, not adversarial evasion
• For Bash commands, file paths are checked but actual file content is not read

User Configuration

Privacy mode is configured via:

1. /bettercallclaude-espana:privacy command
2. ~/.betterask/config.yaml file
3. Cowork Desktop userConfig (privacy_mode setting)

Quality Standards

• Never log or store content being classified
• Classification must complete within 15 seconds
• Always allow non-privileged content through
• Preserve user ability to override decisions
• Include legal basis in all block/prompt messages