docs(compliance): document policy template convention in README and glossary

Add a "Policy templates" section to docs/compliance/README.md explaining
the docs/compliance/templates/ directory, the copy-to-compliance/ workflow,
the [FILL IN:] placeholder convention, and the verification one-liner.

Add four glossary entries: fill-in template, [FILL IN:] marker,
pre-launch compliance checklist, and compliance overview.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
2026-05-20 12:49:50 +00:00
parent ef20345b76
commit a74b7360e1
2 changed files with 39 additions and 0 deletions

View File

@@ -213,6 +213,33 @@ Run `pnpm compliance:sub-processors` after any change to regenerate `compliance/
---
## Policy templates
The `docs/compliance/templates/` directory contains fill-in-the-blank runbooks for the operational policies required before a GDPR-covered launch. These are **template originals** — do not edit them in place.
### Copy-to-`compliance/` workflow
1. Copy the desired template from `docs/compliance/templates/` to `compliance/` (repo root):
```bash
cp docs/compliance/templates/dsr-procedure.template.md compliance/dsr-procedure.md
```
2. Open the copied file and replace every `[FILL IN:]` marker with the project-specific value.
3. Commit the filled file to the repo as a live compliance artifact (same cadence as `compliance/*.yml`).
### `[FILL IN:]` convention
Every placeholder that requires a project-specific value is marked with the literal string `[FILL IN:]` followed by a short description of what is expected. This makes placeholders machine-detectable and easy to audit.
To verify that all placeholders in your live artifacts have been resolved, run:
```bash
grep -rn '\[FILL IN:' compliance/
```
A zero-line result means all templates have been fully filled in. Any output identifies the file and line that still needs attention.
---
## `sccs-required` guidance
Set `sccs-required: true` when: