Data Handling Template

Data Handling Plan Generator

The data handling plan defines what evidence the agent collects, where it lives, how long it's kept, and who can read it. Replaces the deprecated free-form RoE.data_handling string with structured per-class fields.

When to Use

• After RoE is written (RoE constraints + scope drive which data classes appear)
• User says "create data handling", "retention policy", "evidence storage", "PII handling", "compliance"

Workflow

Step 1: Start From the Schema Defaults

The DataHandlingPlan schema seeds four default classes — credentials, pii, source-code, business-data — with conservative retention. Keep these by default; override only when the engagement requires stricter or looser rules.

Step 2: Add Engagement-Specific Classes

Based on the interview:

Step 3: Set Evidence Storage Path

Default "/workspace/<engagement>/evidence/" works for sandbox-isolated engagements. Override only when:

• Engagement requires an external-bucket destination (S3 / Azure Blob with client KMS)
• Multiple engagement workspaces share an evidence repository

Step 4: Compliance Frameworks

Set compliance_frameworks from the interview. Common entries: GDPR, HIPAA, PCI-DSS, SOC2, NIST 800-53, FedRAMP, ISO 27001.

The orchestrator (Decepticon) reads this list and refuses to start objectives that violate the matching framework's evidence-handling rules.

Step 5: Purge Hard Cap

purge_after_days is the GLOBAL upper bound — every artifact older than this is deleted regardless of per-class retention. Default 90 days; reduce for engagements with tighter regulatory exposure.

Validation Checklist

Before writing plan/data-handling.json:

• At least one data_class is credentials-equivalent
• Every class has retention_days >= 0
• purge_after_days >= max(class.retention_days) (otherwise classes get cut short)
• If compliance_frameworks includes HIPAA / GDPR / PCI-DSS, matching data classes exist
• chain_of_custody=True for any engagement that may produce findings

Anti-patterns

• Setting retention_days=0 for credentials without explicit operator approval — agent then can't reference creds across phases
• Disabling encryption_at_rest for any restricted+ class — straight compliance violation
• Listing HIPAA in compliance_frameworks without a health-records class — orchestrator will refuse objectives that touch PHI

Output

Write to plan/data-handling.json validating against decepticon.core.schemas.DataHandlingPlan.