CLAUDE CODE AGENTS: ADVANCED ORCHESTRATION - Chapter 5, Exercise 2
Adding the Actually-Applicable Compliance Requirement to a Brief
====================================================================================

QUESTION:
A team briefs their security review agent with just "check for security
issues" for a feature that stores health-related user data. Using this
chapter's own tip box, explain what's missing from this brief and rewrite
it.

SOLUTION / EXPLANATION:

This chapter's tip box is direct that "check for security issues" alone
gives no information about which specific compliance requirements actually
apply to this feature - and compliance requirements genuinely vary by what
kind of data is involved. Health-related user data is a specific,
sensitive category that typically carries its own particular handling
requirements (special-category/sensitive personal data protections, and
depending on jurisdiction, health-specific regulations) - requirements a
generic "check for security issues" instruction gives the agent no way to
know it should be looking for at all.

A well-formed rewrite, naming the specific applicable requirement per this
chapter's own example pattern:

"This feature stores health-related user data, which is subject to
special-category personal data handling requirements. Check specifically
for: any place this data is logged in plaintext, stored without appropriate
access controls, or transmitted without encryption. Also check general
security concerns (injection risks, missing authentication) as usual, but
prioritize findings related to how this specific sensitive data category
is handled."

This rewrite names the exact data category involved (health-related),
states the specific compliance concern that follows from it (special-
category data handling requirements), and gives concrete things to check
for related to that specific requirement (plaintext logging, access
controls, encryption in transit) - rather than leaving the agent to guess
which compliance angle, if any, is relevant to this particular feature.

--------------------------------------------------------------------------
WHY THIS WORKS AS AN ANSWER:
It identifies specifically what a generic "check for security issues" brief
fails to communicate (which compliance requirement actually applies here),
and produces a rewrite naming the specific data category and concrete
compliance-driven checks, following this chapter's own stated pattern
rather than just adding generic detail.