map-sensitive-actionslisted

# Map Sensitive Actions ## Objective Identify evidence-supported material effects and propose review points without enforcing controls or approving actions. ## Inputs - `audit-scope.json`, `automation-inventory.json`, and `evidence-index.json` with the same `case_id`; - approved local artifacts supporting actions or safeguards; - user-provided control priorities and accountable roles, when available; - an explicit output path for `sensitive-actions.json`. ## Sensitive action classes Consider an action sensitive when it can: - send, publish, approve, or commit a communication; - create a payment, refund, order, contract, or financial record; - grant, revoke, or change access and credentials; - modify, export, retain, or delete business or personal data; - affect employment, eligibility, pricing, safety, or legal obligations; - invoke another system that can perform one of these effects. Do not label ordinary read-only retrieval as sensitive merely because its source is important. Record confidentiality concerns separately. ## Workflow 1. Start from `automation-inventory.json`. 2. Trace each known trigger to its externally observable effects. 3. Preserve gaps when a branch or destination is unknown. 4. Record the current safeguard only when evidence supports it. 5. Propose a review point, stop condition, and accountable role for each material action. 6. Ask a human to confirm priority and whether the map is complete enough for the approved scope. ## Output W