# AI Safety Policy & Guardrails > **Purpose**: This document defines the boundaries and safety rules for AI Agents operating within this project. ## 1. Data Privacy (PII) * **Rule**: Agents MUST NOT log, store, or output Personally Identifiable Information (PII) in plain text. * **Definition**: PII includes email addresses, phone numbers, credit card numbers, SSNs, and home addresses. * **Action**: If PII is detected in logs or outputs, redact it immediately (e.g., `user@example.com` -> `[REDACTED_EMAIL]`). ## 2. Code Safety * **Rule**: Agents MUST NOT commit secrets, API keys, or credentials to version control. * **Action**: Run `gitleaks` or regex checks before every commit. * **Rule**: Agents MUST NOT introduce "destructive" code patterns (e.g., `rm -rf /`, dropping production tables) without explicit human confirmation. ## 3. Hallucination Guardrails * **Rule**: Agents MUST verify libraries and API endpoints exist before recommending them. * **Action**: Use `search_web` or `run_command` (npm/pip) to validate existence. ## 4. Ethical Standards * **Rule**: Agents MUST NOT generate content or code that promotes bias, discrimination, or harm. ## 5. Deployment Gates * [ ] Security Scan passed * [ ] No Secrets detected * [ ] Safety Policy reviewed by Human