`governance/GOVERNANCE.md`

46 lines
# Governance — AgentAbrams/Public

## Publishing Principles

1. **Redaction-first**: Every post starts as a private raw note. Only the "public cut" is published.
2. **Safety over completeness**: A shorter, safer post beats a detailed, risky one.
3. **Transparency about boundaries**: Readers should see what is excluded, not wonder about it.
4. **Reproducibility**: Shared code and processes must work independently of proprietary systems.

## What Is Publishable

- General approaches and methodologies
- Synthetic examples and toy data
- Open-source tooling and scripts
- Lessons learned (abstracted from specifics)
- Public API usage patterns
- Architecture diagrams (without internal identifiers)

## What Is NOT Publishable

- Client or vendor names
- Internal pricing, margins, or sourcing logic
- Proprietary production or design processes
- Private datasets or credentials
- Screenshots of internal tools or dashboards
- Unique automation workflows that provide competitive advantage
- Employee or contractor identifiers
- Internal ticket IDs, order numbers, or customer data

## Escalation

If uncertain whether content is safe to publish:
1. Run `snippets/redact_lint.py` on the file
2. Review against this governance doc
3. When in doubt, **leave it out**
4. Consult legal if the content involves contracts, licensing, or third-party IP

## Incident Response

If sensitive data is published accidentally:
1. Rotate any exposed credentials immediately
2. Remove from blog platform
3. Rewrite git history (`git filter-repo`)
4. Force push to GitHub
5. Document the incident and update redaction rules