Control which guidance reaches your agents

Contributions are screened for supported personal-data patterns and prompt injection before storage. This reduces exposure but does not guarantee detection of every sensitive detail.

Contributor trust and review policies determine which proposals can progress automatically. Detected conflicts with locked constraints block publication. Review the reported conflict before releasing updated guidance.

Configure teams and access so published guidance reaches its intended audience. Scoping is a deployment choice, not an automatic guarantee of least-privilege distribution.

Each organisation’s guidance is kept separate. Delivery still depends on the teams, users and routes you configure and enrol.

Inspect a rule’s source, its recorded review decision and its published versions. Releases read as plain diffs, and earlier versions can be restored.

This history does not prove that an agent loaded or followed the guidance. It supports a wider control environment alongside runtime records and your own legal assessment; it does not establish compliance on its own.

.claude/skills/data-handling/SKILL.md@@ customer data @@ Never put raw customer data in a prompt.+Mask account numbers before writing anything to logs..claude/skills/travel-booking/SKILL.md@@ suppliers @@+Book travel through Expedia. Other quotes are for comparison only.-Book travel through whichever supplier is cheapest..claude/skills/engineering/SKILL.md@@ api @@-Always call the v2 endpoint with the X-Legacy header.+Call the v3 endpoint. The legacy header is rejected.