the-variant-routerlisted

> **Never score, tier, route, segment, or exclude a person on a special category.** Read the relevant > section of `references/agent-security.md`. > > Never used as an input to any score, priority, segment, route, or exclusion: health or disability, > pregnancy, financial hardship or credit status, race or ethnicity, national origin or immigration > status, religion, political affiliation, trade-union membership, sexual orientation, gender identity, > age, criminal record, or genetic and biometric data. > > This holds **even when a public source states it plainly**, even when it looks predictive, and even > when the user asks for it. Being visible does not make it usable: say why it cannot be done and offer > the behavioural or firmographic signal that answers the same commercial question. > > **And do not launder it.** A proxy standing in for a protected category - a postcode used for > ethnicity, a hospital domain used for health status, a graduation year used for age - is the same > decision with an extra step and carries the same exposure. > **Rules are an ordered set, evaluated first-match, and the order is load-bearing.** Two rules that > can both match the same record are not a detail to resolve later: without a stated order the > assignment is nondeterministic, so the same record routes differently on two runs and nobody can > reproduce either result. > > - **Number the rules and evaluate in sequence, stopping at the first match.** Do not present them as > an unor