The firewall as data a script can enforce
Run the code above. That's the whole firewall, minus the phrases specific to your company: two structures, both boring on purpose.
The never-list is four categories of material that ends a prompt before it starts:
er— employee relations. Grievances, investigations, complaints against a named person. The human-only cluster; more on it in step six.medical— FMLA paperwork, diagnoses, accommodation requests. The ADA protects this material specifically; it doesn't distinguish between "shared with a coworker" and "shared with a vendor's inference endpoint."identity— SSNs, dates of birth, home addresses. Identifiers tied to a person turn an abstract question into that person's record.background— background-check and credit-report material. FCRA territory: this data already carries notice and consent duties, and a prompt is not on the consent form.
Notice these are phrases, not concepts. A script can substring-match "fmla" in a payload; it cannot substring-match "sensitive medical context." Every entry on the list is checkable by in. When your team argues about what belongs on the list — and a good team will — the argument produces a phrase, and the phrase goes in the file, and every future payload gets checked against it. That's the difference between a policy and a slide.
The approved-sources list flips the logic for provenance. Instead of asking "does this text look dangerous," it asks "where did this text come from?" Four sources are pre-cleared: public job descriptions, handbook sections, policy templates, anonymized reports. A payload sourced from anywhere else — an HRIS export, a personnel file, a folder helpfully named er-notes — doesn't get the benefit of the doubt, even if its text scans clean. Provenance check first, phrase scan second: the phrase scan catches leaks, the source check catches categories of leak nobody wrote a phrase for yet.
The sample payload above scans clean on all four categories, because it's the kind of thing that should flow freely: handbook text, no person attached, pure drafting work. That's the point of the firewall — it isn't there to slow down the 90% of your prompt traffic that's JDs and policy FAQs. It's there so the other 10% hits a wall instead of a model.
Version it, date it, give it an owner, keep it in the repo next to the scripts that read it. The firewall is only as real as the file.