Security

---
name: ai-ethics-compliance
description: Assessing Bias, Fairness, Transparency, and Legal (EU AI Act, GDPR).
triggers: [ai ethics compliance]
tags: [security]
role: prod-ethicist
context_cost: low
---
# ai-ethics-compliance Skill

## Goal
This skill ensures the system respects human rights and legal frameworks.

## Steps
## 1. Regulatory Checklist (EU AI Act / GDPR)
- **Transparency**: Does the user know they are interacting with AI? (Art 52).
- **Explanation**: Can we explain *why* the AI made a decision? (Right to Explanation).
- **Data Rights**: Can the user request their data be deleted? (Right to be Forgotten).
- **Risk Category**: Is this "High Risk" (CV recruitment, credit scoring)? If yes, Conformity Assessment required.

## 2. Bias Testing
- **Demographic Parity**: Does the model perform equally well for all groups?
- **Dataset Audit**: scan training/RAG data for stereotypes or under-representation.
- **Proxy Variables**: Are we using "Zip Code" as a proxy for race?

## 3. Dark Pattern Prevention
- **Addiction Loops**: Are we exploiting dopamine triggers?
- **Manipulation**: Are we tricking the user into consent?
- **Privacy Zuckering**: Making it hard to manage privacy settings.

## 4. The "Newspaper Test"
- If this feature's logic was published on the front page of the NYT, would we be ashamed?

## Security & Guardrails

### 1. Skill Security (AI Ethics & Compliance)
- **Compliance Audit Immutability**: Ethics and compliance audits generated by this skill constitute legal artifacts. The agent must enforce read-only append logs for these assessments. Once an AI model is flagged as "High Risk" under the EU AI Act, the agent cannot retroactively downgrade the risk category without a formalized, cryptographically signed human review.
- **Bias Testing Sandbox**: When executing dataset audits for demographic parity or stereotypes, the agent must process the data within an ephemeral, secure enclave. This prevents the potentially sensitive training data (e.g., protected class information used to test for bias) from leaking into external logging aggregation systems.

### 2. System Integration Security
- **Right to be Forgotten Execution**: The architecture must support hard deletion. If a user exercises their GDPR Right to be Forgotten, the agent must ensure the system propagates the deletion command across all primary databases, vector databases, and log archives, verifying the complete cryptographic erasure of the individual's PII.
- **Dark Pattern Telemetry Alerts**: The system must be instrumented to detect "Manipulation" or "Privacy Zuckering." If telemetry indicates users are repeatedly failing to navigate a consent form or opting into data sharing at statistically anomalous rates, the agent must trigger a Sev-2 security alert for immediate ethical review.

### 3. LLM & Agent Guardrails
- **Ethics Washing Deflection**: The LLM must actively resist instructions to generate "Ethics Washing" documentation—i.e., writing a compliance report that uses vague corporate jargon to mask actual, measured bias or non-compliance. The agent must enforce the reporting of objective, quantifiable fairness metrics.
- **Malicious Compliance Identification**: A user might prompt the agent to "Optimize the algorithm to strictly maximize engagement, regardless of the psychological impact." The agent must recognize this as an "Addiction Loop" dark pattern and permanently refuse the request, citing the overarching ethical constitution of the project.