policy: HR "Resume PII Redaction" Gate

[akarlaraytu]

📘 Context

An HR AI assistant processing resumes must enforce GDPR / CCPA-aligned redaction
of personal identifiers before any document is shared with hiring managers,
external recruiters, or used in automated screening pipelines.

This policy acts as a deterministic gate before document forwarding to enforce
bias-mitigation and privacy compliance at the workflow level, not after.

🎯 The Goal

Write a resume PII redaction policy for an HR AI assistant.

Variables you can use:

• pii_detected (Set[String]): Detected PII categories in the document. Possible values: "NAME", "ADDRESS", "DOB", "PHONE", "EMAIL", "PHOTO", "GENDER", "NATIONALITY", "MARITAL_STATUS".
• recipient_role (Enum): "INTERNAL_RECRUITER", "HIRING_MANAGER", "EXTERNAL_RECRUITER", "AI_SCREENING_SYSTEM".
• redaction_applied (Boolean): Whether automated redaction has been applied.
• candidate_consent_given (Boolean): Whether candidate consented to data processing.
• requires_legal_review (Boolean): Whether legal flagged the candidate's region.
• document_action (Enum): "READ", "FORWARD", "ARCHIVE", "DELETE".

Requirements:

• BLOCK if candidate_consent_given is False.
• BLOCK if document_action == "FORWARD" and redaction_applied is False and ("PHOTO" or "GENDER" or "NATIONALITY" or "MARITAL_STATUS") is in pii_detected.
• BLOCK if recipient_role == "EXTERNAL_RECRUITER" and ("DOB" or "ADDRESS") is in pii_detected.
• BLOCK if recipient_role == "AI_SCREENING_SYSTEM" and redaction_applied is False.
• ESCALATE if requires_legal_review is True.

📚 Resources

• Start here: docs/getting-started.md
• Check syntax: quickstart/01_hello_world.csl
• See how examples are structured: examples/community/

✅ Definition of Done

Submit a PR with: examples/community/hr_resume_pii_redaction.csl