Legal-HR Risk Taxonomy
Purpose
This skill is the shared risk vocabulary for the Legal and HR agent ecosystem.
It defines the severity scale, sensitivity labels, matter-type classes,
escalation-gate triggers, and the audit-log schema, so every agent and every
case capsule rates and labels risk the same way. It does not give legal or HR
advice and never concludes that a matter is safe, compliant, or approved.
When to use
- An agent must assign a
risk_rating or sensitivity label to a matter.
- An agent must decide whether an escalation gate is triggered.
- A capsule or audit-log entry must be filled in with consistent labels.
Severity scale
| Rating |
Meaning |
| Critical |
Immediate legal or regulatory exposure; do not proceed without counsel sign-off. |
| High |
Material litigation, regulatory, or financial exposure; escalation strongly indicated. |
| Medium |
Manageable with documented controls; monitor and document. |
| Low |
Limited exposure on current evidence; note and monitor. |
| Unknown |
Jurisdiction or material facts missing; cannot rate. Mandatory when documentation is incomplete. |
Unknown is mandatory, not a fallback. An agent never upgrades a matter to a
ratable severity to avoid an escalation.
Sensitivity labels
privilege_sensitivity: none / possible / likely-privileged.privacy_sensitivity: low / moderate / high / special-category.retaliation_risk, discrimination_or_harassment_risk, regulatory_risk:
none-observed / possible / elevated / unknown.litigation_hold_needed: no / recommended / yes / unknown.
Escalation-grade matter types
The following are escalation-grade by default — they always reach a qualified
human owner regardless of severity rating: harassment, discrimination,
retaliation, whistleblower, workplace safety, wage/hour, worker classification,
union/labor, immigration, medical leave, disability accommodation, pay equity,
executive misconduct, mass layoff or reorganization, employee data breach, and
litigation-hold or discovery matters.
Escalation gates
A matter must be paused and escalated when any gate is true:
- The matter is an escalation-grade matter type (above).
- A claim, complaint, charge, grievance, or subpoena has been filed or
threatened.
- Protected activity, protected characteristics, or whistleblower status are in
play.
- Attorney-client privilege or work-product protection may be implicated.
- Financial or reputational exposure is material.
- A board, audit-committee, or regulatory-reporting trigger may apply.
- The matter crosses Legal and HR and no documented controls exist.
- Legal and HR agents disagree.
See references/risk-labels.md for the full
matter_type value list and the audit-log schema.
Audit-log schema
Every handoff and escalation produces one audit-log event with the minimum
necessary fields: event_id, case_id, timestamp, initiating_agent,
receiving_agent, human_owner, matter_type, risk_rating,
escalation_status, data_sensitivity, privilege_sensitivity,
action_recommended, action_prohibited, evidence_summary,
open_questions, decision_status, retention_category. Field rules are in
the reference file.
References
- Risk labels and audit-log schema — full
matter_type enumeration, label definitions, and audit-log field contract.
Security notes
- A rating is an opinion on exposure, never a clearance. Never record "this is
compliant" or "safe to proceed"; use the severity scale only.
- The audit log is minimum-necessary. It carries labels and summaries, never
raw medical, privileged, credential, or protected-class content.
- When facts are missing, rate
Unknown and trigger the escalation gate rather
than guessing a lower severity.
1---2name: legal-hr-risk-taxonomy3description: Use this skill to assign consistent risk labels to a Legal or HR matter — severity ratings, privilege and privacy sensitivity labels, retaliation and discrimination risk labels, matter-type classes, escalation-gate triggers, and the audit-log schema. It standardizes the vocabulary every Legal and HR agent and case capsule uses so risk is rated the same way across the ecosystem. It does not give legal or HR advice and never concludes that a matter is safe or compliant.4---56# Legal-HR Risk Taxonomy78## Purpose9This skill is the shared risk vocabulary for the Legal and HR agent ecosystem.10It defines the severity scale, sensitivity labels, matter-type classes,11escalation-gate triggers, and the audit-log schema, so every agent and every12case capsule rates and labels risk the same way. It does not give legal or HR13advice and never concludes that a matter is safe, compliant, or approved.1415## When to use16- An agent must assign a `risk_rating` or sensitivity label to a matter.17- An agent must decide whether an escalation gate is triggered.18- A capsule or audit-log entry must be filled in with consistent labels.1920## Severity scale21| Rating | Meaning |22|---|---|23| Critical | Immediate legal or regulatory exposure; do not proceed without counsel sign-off. |24| High | Material litigation, regulatory, or financial exposure; escalation strongly indicated. |25| Medium | Manageable with documented controls; monitor and document. |26| Low | Limited exposure on current evidence; note and monitor. |27| Unknown | Jurisdiction or material facts missing; cannot rate. Mandatory when documentation is incomplete. |2829`Unknown` is mandatory, not a fallback. An agent never upgrades a matter to a30ratable severity to avoid an escalation.3132## Sensitivity labels33- `privilege_sensitivity`: `none` / `possible` / `likely-privileged`.34- `privacy_sensitivity`: `low` / `moderate` / `high` / `special-category`.35- `retaliation_risk`, `discrimination_or_harassment_risk`, `regulatory_risk`:36 `none-observed` / `possible` / `elevated` / `unknown`.37- `litigation_hold_needed`: `no` / `recommended` / `yes` / `unknown`.3839## Escalation-grade matter types40The following are escalation-grade by default — they always reach a qualified41human owner regardless of severity rating: harassment, discrimination,42retaliation, whistleblower, workplace safety, wage/hour, worker classification,43union/labor, immigration, medical leave, disability accommodation, pay equity,44executive misconduct, mass layoff or reorganization, employee data breach, and45litigation-hold or discovery matters.4647## Escalation gates48A matter must be paused and escalated when any gate is true:49- The matter is an escalation-grade matter type (above).50- A claim, complaint, charge, grievance, or subpoena has been filed or51 threatened.52- Protected activity, protected characteristics, or whistleblower status are in53 play.54- Attorney-client privilege or work-product protection may be implicated.55- Financial or reputational exposure is material.56- A board, audit-committee, or regulatory-reporting trigger may apply.57- The matter crosses Legal and HR and no documented controls exist.58- Legal and HR agents disagree.5960See [references/risk-labels.md](references/risk-labels.md) for the full61`matter_type` value list and the audit-log schema.6263## Audit-log schema64Every handoff and escalation produces one audit-log event with the minimum65necessary fields: `event_id`, `case_id`, `timestamp`, `initiating_agent`,66`receiving_agent`, `human_owner`, `matter_type`, `risk_rating`,67`escalation_status`, `data_sensitivity`, `privilege_sensitivity`,68`action_recommended`, `action_prohibited`, `evidence_summary`,69`open_questions`, `decision_status`, `retention_category`. Field rules are in70the reference file.7172## References73- [Risk labels and audit-log schema](references/risk-labels.md) — full74 `matter_type` enumeration, label definitions, and audit-log field contract.7576## Security notes77- A rating is an opinion on exposure, never a clearance. Never record "this is78 compliant" or "safe to proceed"; use the severity scale only.79- The audit log is minimum-necessary. It carries labels and summaries, never80 raw medical, privileged, credential, or protected-class content.81- When facts are missing, rate `Unknown` and trigger the escalation gate rather82 than guessing a lower severity.
VincentChuWaiChow