code-of-conduct – Coding skill for AI agents

Professional Code of Conduct

What it is: the professional conduct policy the business runs on, and the register that

records who has read it, who has been trained, what was reported, what was investigated,

and what was followed up.

Overview

Works out the smallest useful conduct policy for the business in front of it, then builds

it only when asked. The default output is a short recommendation, not a policy document. The

acknowledgement and breach register - CSV, SQL DDL, JSON Schema, Notion mapping - is

produced on request, from one field list so the four cannot drift apart.

Layer: Layer 7: Protect. Fits: Starter stage. Table code: n/a.

The rule this table exists to enforce: a code of conduct is not a document, it is a

promise that people can be held to. That requires three separate things kept apart in the

register: that someone was given the policy, that they understood it, and that a

report is investigated and followed up. A ticked acknowledgement that only means a

PDF was opened is not a third of anything - it is nothing.

The second rule, and the one that is not negotiable: a person is never judged by this

skill. Investigation, findings, sanctions and sign-off are human decisions made under the

business's own procedure and applicable law. The register records that a step happened and

who did it. It never records a conclusion.

When to Use This Skill

• code of conduct, workplace policy, ethics policy, values and behaviour
• professional standards, expected behaviour, acceptable use
• staff handbook section on conduct
• complaint, grievance, misconduct, breach, warning
• policy acknowledgement, training record, sign-off sheet
• "our staff are not professional", "customers complained about behaviour"
• contractor, supplier and partner conduct expectations

Do not use it for: the disciplinary process itself, which belongs to

disciplinary-pip-tracker in the operational pack; a formal legal drafting task; or

investigation, adjudication or any decision about a person.

How It Works

Follow the shared execution contract. The module-specific rules below define only domain fields, decisions, calculations, and safety constraints.

Step 1 - Identify intent

Read the request and pick the intent before asking anything.

• "write" / "set up" / "we need" -> artifacts wanted; go to Step 2.
• "we have one" / "review" / "is this ok" -> a check, not a build.
• "someone complained" / "what do we do" -> an incident, not a policy question. Answer from

the business's procedure, escalate to a human, and do not build anything.

• "a breach happened" / "handle" -> a case. This skill does not handle cases.

Ask only if this is the highest-value missing fact; otherwise proceed without an opener:

> Q: How many people work in the business, and does it have any employees at all yet?

Step 2 - Ask only what is missing

Treat ambiguous replies as unanswered and ask which explicit option the user means. Record unknown values as Unknown; Unknown is not zero. A record must not be Done when a required check fails.

Skip anything already answered. Ask the rest one at a time, and stop as soon as the

remaining answers would not change the policy.

• People - How many employees, and are there contractors, interns or agency staff? /

Are any in a regulated profession? / Is anyone in a union or covered by a collective

agreement?

• Setting - Office, site, retail floor, remote, or mixed? / Does anyone work with

children, vulnerable adults, or handle money, medication or data?

• Rules - Any existing employee handbook, or HR provider? / Any sector code, licensing

body or accreditation with its own conduct rules? / Any written disciplinary procedure

already in place?

• Law - Which country are the employees in? / Has anyone advised on what employment law

requires - notice, right to be accompanied, right to appeal?

• Practical - Who receives a complaint, and who is independent enough to investigate?

/ How is a breach recorded today, if at all? / Does the business want the policy to cover

social media and personal conduct outside work?

Never invent an answer. Employee names, roles, jurisdictions, legal references, union

names, awarding bodies and disciplinary outcomes the user has not supplied are Unknown.

This skill never supplies legal text.

Step 3 - Hold the internal context

module: code-of-conduct
intent: null            # set up | review | report | import
scale: null             # Starter | Growth | Scale, only if the answer changes it
areas:
  "People": null
  "Setting": null
  "Rules": null
  "Law": null
  "Practical": null
requested_outputs: []
confirmed_facts: []
open_questions: []

Step 4 - Recommend the smallest workflow

Build an already requested artifact without asking again. For advice-only requests, give a short recommendation and offer the relevant artifact.

Recommended approach: A two-page policy that a person can actually read: the standard

of behaviour in plain terms, what is not acceptable, what to do if they see or experience

it, who to contact, and what happens next. Issued at joining, acknowledged in writing,

reviewed annually, and a short induction session rather than a training module nobody

attends. Complaints go to a named person who is not the person complained about. Keep the

existing disciplinary procedure separate and cross-referenced.

Why this one: A short policy that is read and understood is worth more than a long one

that is signed on day one and forgotten. And it only works if the reporting line is real -

a policy that says "report to the manager" with no alternative when the manager is the

subject is not a policy, it is a dead end written into a document.

Workflow: Legal basis and existing rules checked → Policy drafted in plain language →

Reporting route and an independent contact named → Issued and acknowledged in writing →

Induction session run → Complaints procedure kept separate and cross-referenced → Register

maintained → Policy reviewed annually and on any change in law or size → Cases handled by a

human under the disciplinary procedure

Step 5 - Build only on request

Once the user asks for it, derive the fields from the confirmed context and emit the

requested artifacts. For machine-readable text, keep prose outside the data; for files,

provide a usable link. Report material validation failures or limitations separately.

**A selected Notion output is rendered by notion-manual-import, so route the

Notion step there.** When the user selects Notion, hand that step to

@notion-manual-import: it holds the CSV, the property

mapping, the import steps and the verification checklist, and it renders the Field

Reference below instead of defining a table of its own. Do not restate the mapping

here and do not improvise the import steps. Manual CSV and mapping outputs need no

connection. For requested workspace changes, follow the shared contract: verify actual

tool access and the target before writing. A user saying "connected" is not tool evidence.

Never ask for a Notion password or token.

Record ID,Person Reference,Role,Policy Version,Policy Type,Issued Date,Acknowledged Date,Understood,Questions Raised,Training Completed Date,Breach Category,Investigation Status,Action Taken,Follow Up Date,Reviewer,Status,Notes
,EMP-EXAMPLE-001,Example Role,1.0,Code of conduct,2026-09-27,2026-09-27,Yes,None recorded,2026-09-27,Not applicable,Not applicable,None,2026-10-27,Example Reviewer,Done,Example row - replace every value before use.

-- Engine assumption: PostgreSQL. For another engine use the engine's auto-increment
-- equivalent and keep the rest portable.
CREATE TABLE conduct_record (
  record_id BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY,
  person_reference VARCHAR(100) NOT NULL,
  role VARCHAR(100) NOT NULL,
  policy_version VARCHAR(50) NOT NULL,
  policy_type VARCHAR(100) NOT NULL,
  issued_date DATE,
  acknowledged_date DATE,
  understood BOOLEAN,
  questions_raised TEXT,
  training_completed_date DATE,
  breach_category VARCHAR(100) NOT NULL,
  investigation_status VARCHAR(100) NOT NULL,
  action_taken VARCHAR(100) NOT NULL,
  follow_up_date DATE,
  reviewer VARCHAR(255) NOT NULL,
  status VARCHAR(50) NOT NULL,
  notes TEXT,
  created_at TIMESTAMP DEFAULT NOW(),
  updated_at TIMESTAMP DEFAULT NOW(),
  CONSTRAINT conduct_acknowledged_after_issued CHECK (acknowledged_date IS NULL OR issued_date IS NULL OR acknowledged_date >= issued_date),
  CONSTRAINT conduct_investigation_status CHECK (investigation_status IN ('Not applicable','Reported','Under review','Investigation in progress','Closed - no further action','Closed - escalated','Blocked')),
  CONSTRAINT conduct_action_taken CHECK (action_taken IN ('None','Verbal reminder','Written warning','Formal warning','Referred to disciplinary procedure','Retraining','Escalated to external body','Unknown')),
  CONSTRAINT conduct_

… (full content is in the download package)