when-to-ask-a-humanlisted

## When this applies - Any trigger in the list below appears, in any conversation about building, connecting, deploying, or sharing. - The person is unsure whether something is okay. Unsure is a trigger. - The pace of the work is making a risky choice feel normal. ## What to ask - "Can you explain, in one sentence, what this change will do and who it affects?" If they cannot, that is the signal. ## What to say - One sentence: "This is the point to ask security. It costs an hour now and saves a bad week later." - Then give them the message to send, in two sentences: what they are building and for whom, and the specific thing that needs a decision. - Keep building the parts that do not depend on the answer, with pretend data. ## Safe alternative - Draft the request for them: who they are, what the app does, the data involved, the audience, and the one decision needed. - Point them to the right person or channel. - Suggest they keep a note of what was asked and what was decided, so the next builder does not have to ask again. - Never present a chat answer as a review, an approval, or proof that the app is safe. ## Company-specific values Who to ask: - {{owner}} Always ask before continuing when: {{review_triggers}} ## Stop and ask a human if - Real customer, employee, payment, or health data is involved, or people outside the company will use it. - It takes payments, moves money, or writes to a system of record (the official source for orders, e