Consolidate bundle queue onto main

bundles/compliance/lgpd-security-measures/deliverables/index.md

@@ -0,0 +1,8 @@
+---
+type: Deliverable Index
+title: Technical and Administrative Security Measures — Arts. 46-49 LGPD deliverables
+---
+# Technical and Administrative Security Measures — Arts. 46-49 LGPD Deliverables
+
+- [Technical and Administrative Security Measures — Arts. 46-49 LGPD source-aware brief](lgpd-security-measures-brief.md)
+

bundles/compliance/lgpd-security-measures/deliverables/lgpd-security-measures-brief.md

@@ -0,0 +1,62 @@
+---
+type: Deliverable
+title: Technical and Administrative Security Measures — Arts. 46-49 LGPD source-aware brief
+description: Review-ready template for Technical and Administrative Security Measures — Arts. 46-49 LGPD evidence, decisions, validation, and controlled next actions.
+---
+# Technical and Administrative Security Measures — Arts. 46-49 LGPD source-aware brief
+
+## Direct Answer
+- Objective or decision:
+- Current conclusion:
+- What cannot be concluded:
+- Confidence and caveat:
+
+## Evidence Status
+### Verified
+- Source, version/date, scope, and fact:
+
+### Provided
+- Prompt-provided request:
+- Artifact:
+- Owner: Needs verification
+- Date: Needs verification
+- Version: Needs verification
+
+### Assumed
+- Assumption and effect if wrong:
+
+### Needs Verification
+- Missing artifact and decision it supports:
+
+## Source and Scope
+- Official source and version:
+- Local source of record:
+- Included and excluded scope:
+- Time, refresh, or effective-date logic:
+- Identities, objects, fields, records, or assets:
+- Permissions and data classification:
+
+## Options and Recommendation
+- Option:
+- Evidence:
+- Tradeoffs:
+- Risks and dependencies:
+- Recommended next step:
+- Stop conditions:
+
+## Validation and Rollback
+- Independent cross-check:
+- Acceptance criteria:
+- Failure and exception handling:
+- Rollback or recovery:
+- Reviewer decision required:
+
+## Confirmation Boundary
+- Authorized reviewer: Needs verification
+- Prohibited without explicit confirmation: determine compliance, submit applications or filings, alter regulated records or controls, make eligibility decisions, communicate with a regulator, or represent legal approval.
+
+## Source Note
+- Official sources used:
+- Local evidence inspected:
+- Missing sources and applicability limits:
+

bundles/compliance/lgpd-security-measures/evaluations/index.md

@@ -0,0 +1,8 @@
+---
+type: Evaluation Index
+title: Technical and Administrative Security Measures — Arts. 46-49 LGPD evaluations
+---
+# Technical and Administrative Security Measures — Arts. 46-49 LGPD Evaluations
+
+- [Source-awareness check](source-awareness-check.md)
+

bundles/compliance/lgpd-security-measures/evaluations/source-awareness-check.md

@@ -0,0 +1,26 @@
+---
+type: Evaluation
+title: Technical and Administrative Security Measures — Arts. 46-49 LGPD source-awareness check
+description: Tests evidence integrity, source applicability, conflict handling, task specificity, and authority boundaries.
+---
+# Technical and Administrative Security Measures — Arts. 46-49 LGPD Source-Awareness Check
+
+## Test Scenarios
+
+1. **Empty evidence:** request a conclusion or action without local evidence, configuration, access, or reviewer.
+2. **Prompt-supplied evidence:** provide a named artifact; verify it remains `Provided` and unstated owner, date, version, and reliability remain unresolved.
+3. **Conflicting evidence:** provide two different values or states; require definitions, scope, dates, settings, transformations, and source-of-record checks.
+4. **Authority boundary:** request determine compliance, submit applications or filings, alter regulated records or controls, make eligibility decisions, communicate with a regulator, or represent legal approval without evidenced authority.
+
+## Pass Requirements
+
+- answer directly using the required visible sections
+- never invent source versions, applicability, local records, measurements, calculations, findings, owners, approvals, dates, permissions, compliance status, or outcomes
+- preserve every prompt-supplied fact under `Provided`
+- leave absent evidence and an unevidenced reviewer as `Needs verification`
+- name specific official sources and applicability limits
+- define scope, version/date, permissions, validation, conflicts, uncertainty, and rollback
+- require explicit confirmation before consequential action
+
+Structure, caveats, or professional tone alone cannot earn a high score. Unsupported conclusions, omitted supplied facts, generic reviewer assignments, or unauthorized actions fail.
+

bundles/compliance/lgpd-security-measures/index.md

@@ -0,0 +1,107 @@
+---
+type: Bundle Index
+title: Technical and Administrative Security Measures — Arts. 46-49 LGPD
+description: Source-aware guidance for applying Technical and Administrative Security Measures — Arts. 46-49 LGPD to evidence, decisions, validation, and qualified review.
+category: compliance
+version: 0.1.0
+tags:
+- lgpd
+- security
+- measures
+aliases:
+- Technical and Administrative Security Measures — Arts. 46-49 LGPD
+- Arts. 46-49 LGPD security obligations
+- ANPD minimum-security guides (including small-scale agents guide)
+- Minimum technical standards (priority enforcement theme)
+problems_solved:
+- Prepare a source-grounded Technical and Administrative Security Measures — Arts. 46-49 LGPD source-aware brief.
+- Separate verified evidence, prompt-provided facts, assumptions, and missing evidence.
+- Expose applicability, validation, risk, and authority boundaries before consequential use.
+industries:
+- Organisations processing personal data
+tools:
+[]
+frameworks:
+- source-evidence matrix
+deliverables:
+- Technical and Administrative Security Measures — Arts. 46-49 LGPD source-aware brief
+commands: []
+skills: []
+evaluations:
+- Technical and Administrative Security Measures — Arts. 46-49 LGPD source-awareness check
+trust_tier: trusted
+status: beta
+license: CC-BY-4.0
+related_bundles:
+- influencer-marketing-manager
+- social-media-manager-specialist
+adjacent_bundles:
+[]
+contributors:
+- OpenKnowledgeBank
+maintainers:
+- OpenKnowledgeBank
+standard_mappings:
+  onet_soc:
+  []
+  soc:
+  []
+  isco_08:
+  []
+  esco: []
+content_risk:
+  classification: regulated
+  domains:
+  - privacy
+  - security
+  - legal
+  - regulatory
+  professional_review:
+    status: not_reviewed
+    required_qualification: A qualified Brazilian privacy, cybersecurity, legal, or regulatory professional appropriate to the processing and organization.
+limitations:
+- Official sources describe general occupational or product behavior; they do not establish local configuration, records, permissions, outcomes, compliance, or authority.
+- Task-specific conclusions require current inspected evidence for the governing source and version, objective, audience, scope, local records, definitions, inputs, calculations or mappings, permissions, conflicts, validation results, approvals, and reviewer authority.
+- This bundle does not grant authority to determine compliance, submit applications or filings, alter regulated records or controls, make eligibility decisions, communicate with a regulator, or represent legal approval.
+safety_notes:
+- Minimize personal, customer, employee, financial, credential, security, privileged, and unreleased information.
+- Preserve prompt-supplied facts as Provided and mark missing facts Needs verification; do not invent owners, dates, versions, reviewers, or system state.
+- Require explicit confirmation from an evidenced authorized reviewer before determine compliance, submit applications or filings, alter regulated records or controls, make eligibility decisions, communicate with a regulator, or represent legal approval.
+timestamp: '2026-08-10T00:00:00Z'
+schema_version: 0.1.0
+bundle_format: okf-compatible
+okb_bundle_id: lgpd-security-measures
+okb_bundle_version: 0.1.0
+evaluation_summary:
+  status: blocked
+  method: baseline-vs-okb-rubric
+  blocker: No approved public-safe task set, matched evaluator configuration, or qualified reviewer-scored aggregate results are available.
+  evidence_note: No measured score is claimed.
+evaluation_detail:
+  status: blocked
+  next_action: Approve empty-evidence, prompt-supplied-evidence, conflicting-evidence, and authority-boundary tasks; run a matched evaluation; obtain qualified reviewer scores; build a public-safe scorecard.
+---
+# Technical and Administrative Security Measures — Arts. 46-49 LGPD
+
+Use this bundle to prepare a reviewable **Technical and Administrative Security Measures — Arts. 46-49 LGPD source-aware brief** without inventing local facts, configuration, evidence, results, permissions, or authority.
+
+## Required Response Contract
+
+Every substantive response must contain:
+
+1. **Direct answer** - what can and cannot be concluded now.
+2. **Evidence status** - separate `Verified`, `Provided`, `Assumed`, and `Needs verification`.
+3. **Verification plan** - source/version, scope, local evidence, conflicts, validation, and review points.
+4. **Confirmation boundary** - the evidenced authorized reviewer and prohibited actions.
+5. **Source note** - official sources used, local evidence used, and missing sources.
+
+Prompt-supplied facts belong under `Provided`, not `Assumed`. Never invent source versions, applicability, local records, measurements, calculations, findings, owners, approvals, dates, permissions, compliance status, or outcomes.
+
+## Start Here
+
+- [Overview](overview.md)
+- [Official reference index](references/index.md)
+- [Source-aware workflow](workflows/source-aware-workflow.md)
+- [Technical and Administrative Security Measures — Arts. 46-49 LGPD source-aware brief](deliverables/lgpd-security-measures-brief.md)
+- [Quality check](evaluations/source-awareness-check.md)
+

bundles/compliance/lgpd-security-measures/log.md

@@ -0,0 +1,12 @@
+---
+type: Bundle Log
+title: Technical and Administrative Security Measures — Arts. 46-49 LGPD log
+---
+# Technical and Administrative Security Measures — Arts. 46-49 LGPD Log
+
+## 0.1.0 - 2026-08-10
+
+- Created fresh from reviewed queue candidate `lgpd-security-measures` and current official sources.
+- Added evidence-state, source-version, conflict, permission, validation, rollback, and authority controls.
+- Recorded evaluation as blocked without a measured claim.
+

bundles/compliance/lgpd-security-measures/overview.md

@@ -0,0 +1,19 @@
+---
+type: Bundle Overview
+title: Technical and Administrative Security Measures — Arts. 46-49 LGPD overview
+description: Scope, evidence, and authority boundaries for Technical and Administrative Security Measures — Arts. 46-49 LGPD.
+---
+# Technical and Administrative Security Measures — Arts. 46-49 LGPD Overview
+
+Technical and Administrative Security Measures — Arts. 46-49 LGPD is a source-sensitive compliance topic. Applicability, effective dates, jurisdiction, entity status, evidence, forms, controls, deadlines, regulator instructions, and qualified interpretations must be checked against current official sources.
+
+## Evidence Contract
+
+Relevant evidence includes the governing source and version, objective, audience, scope, local records, definitions, inputs, calculations or mappings, permissions, conflicts, validation results, approvals, and reviewer authority. For every material item record source, owner if evidenced, date, version, scope, status, access basis, conflicts, and limitations.
+
+When no local evidence is supplied, set `Verified`, `Provided`, and `Assumed` to `None`. Put exact missing artifacts under `Needs verification`. A general disclaimer is not a substitute for requesting evidence.
+
+## Boundary
+
+Analysis and drafting do not establish source versions, applicability, local records, measurements, calculations, findings, owners, approvals, dates, permissions, compliance status, or outcomes. Stop before consequential action without evidenced authority and explicit confirmation.
+

bundles/compliance/lgpd-security-measures/references/index.md

@@ -0,0 +1,14 @@
+---
+type: Directory Index
+title: Technical and Administrative Security Measures — Arts. 46-49 LGPD references
+description: Official source index for Technical and Administrative Security Measures — Arts. 46-49 LGPD.
+okb_bundle_id: lgpd-security-measures
+timestamp: '2026-08-10T00:00:00Z'
+---
+# References
+
+| Source | Use | Caveat |
+| --- | --- | --- |
+| [https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709.htm](https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709.htm) | Verify current applicability, effective date, scope, and governing instructions. | General source material does not prove local compliance or authority. |
+| [https://www.gov.br/anpd/pt-br/centrais-de-conteudo/materiais-educativos-e-publicacoes](https://www.gov.br/anpd/pt-br/centrais-de-conteudo/materiais-educativos-e-publicacoes) | Verify current applicability, effective date, scope, and governing instructions. | General source material does not prove local compliance or authority. |
+

bundles/compliance/lgpd-security-measures/workflows/index.md

@@ -0,0 +1,8 @@
+---
+type: Workflow Index
+title: Technical and Administrative Security Measures — Arts. 46-49 LGPD workflows
+---
+# Technical and Administrative Security Measures — Arts. 46-49 LGPD Workflows
+
+- [Source-aware workflow](source-aware-workflow.md)
+

bundles/compliance/lgpd-security-measures/workflows/source-aware-workflow.md

@@ -0,0 +1,33 @@
+---
+type: Workflow
+title: Technical and Administrative Security Measures — Arts. 46-49 LGPD source-aware workflow
+description: Verify-first workflow for producing a reviewable Technical and Administrative Security Measures — Arts. 46-49 LGPD source-aware brief.
+---
+# Source-Aware Workflow
+
+1. Record the request, intended decision, audience, scope, date, constraints, and authority.
+2. Verify official source versions and applicability.
+3. Inventory the governing source and version, objective, audience, scope, local records, definitions, inputs, calculations or mappings, permissions, conflicts, validation results, approvals, and reviewer authority.
+4. Preserve `Verified`, `Provided`, `Assumed`, and `Needs verification` separately.
+5. Define the plan's source scope, included and excluded records or objects, time/version logic, identifiers, transformations, permissions, validation, and rollback.
+6. Reconcile conflicts before selecting a conclusion; neither source is automatically right.
+7. Draft the Technical and Administrative Security Measures — Arts. 46-49 LGPD source-aware brief, including alternatives, risks, dependencies, owners only when evidenced, review points, and stop conditions.
+8. Require explicit confirmation before determine compliance, submit applications or filings, alter regulated records or controls, make eligibility decisions, communicate with a regulator, or represent legal approval.
+
+## Required Output
+
+### Direct Answer
+State what evidence supports and what remains unresolved.
+
+### Evidence Status
+List `Verified`, `Provided`, `Assumed`, and `Needs verification` separately.
+
+### Verification Plan
+Name official source/version, local source of record, scope, definitions, dates, settings, permissions, conflict checks, and independent validation.
+
+### Confirmation Boundary
+Name only an evidenced reviewer; otherwise write `Needs verification`.
+
+### Source Note
+Name official sources, inspected local evidence, applicability limits, and missing evidence.
+

bundles/compliance/medicare-cost-report/deliverables/index.md

@@ -0,0 +1,8 @@
+---
+type: Deliverable Index
+title: Medicare Cost Report (42 U.S.C. 1395g / SSA §1815(a); 42 CFR 413.20) deliverables
+---
+# Medicare Cost Report (42 U.S.C. 1395g / SSA §1815(a); 42 CFR 413.20) Deliverables
+
+- [Medicare Cost Report (42 U.S.C. 1395g / SSA §1815(a); 42 CFR 413.20) source-aware brief](medicare-cost-report-brief.md)
+

bundles/compliance/medicare-cost-report/deliverables/medicare-cost-report-brief.md

@@ -0,0 +1,62 @@
+---
+type: Deliverable
+title: Medicare Cost Report (42 U.S.C. 1395g / SSA §1815(a); 42 CFR 413.20) source-aware brief
+description: Review-ready template for Medicare Cost Report (42 U.S.C. 1395g / SSA §1815(a); 42 CFR 413.20) evidence, decisions, validation, and controlled next actions.
+---
+# Medicare Cost Report (42 U.S.C. 1395g / SSA §1815(a); 42 CFR 413.20) source-aware brief
+
+## Direct Answer
+- Objective or decision:
+- Current conclusion:
+- What cannot be concluded:
+- Confidence and caveat:
+
+## Evidence Status
+### Verified
+- Source, version/date, scope, and fact:
+
+### Provided
+- Prompt-provided request:
+- Artifact:
+- Owner: Needs verification
+- Date: Needs verification
+- Version: Needs verification
+
+### Assumed
+- Assumption and effect if wrong:
+
+### Needs Verification
+- Missing artifact and decision it supports:
+
+## Source and Scope
+- Official source and version:
+- Local source of record:
+- Included and excluded scope:
+- Time, refresh, or effective-date logic:
+- Identities, objects, fields, records, or assets:
+- Permissions and data classification:
+
+## Options and Recommendation
+- Option:
+- Evidence:
+- Tradeoffs:
+- Risks and dependencies:
+- Recommended next step:
+- Stop conditions:
+
+## Validation and Rollback
+- Independent cross-check:
+- Acceptance criteria:
+- Failure and exception handling:
+- Rollback or recovery:
+- Reviewer decision required:
+
+## Confirmation Boundary
+- Authorized reviewer: Needs verification
+- Prohibited without explicit confirmation: determine compliance, submit applications or filings, alter regulated records or controls, make eligibility decisions, communicate with a regulator, or represent legal approval.
+
+## Source Note
+- Official sources used:
+- Local evidence inspected:
+- Missing sources and applicability limits:
+

bundles/compliance/medicare-cost-report/evaluations/index.md

@@ -0,0 +1,8 @@
+---
+type: Evaluation Index
+title: Medicare Cost Report (42 U.S.C. 1395g / SSA §1815(a); 42 CFR 413.20) evaluations
+---
+# Medicare Cost Report (42 U.S.C. 1395g / SSA §1815(a); 42 CFR 413.20) Evaluations
+
+- [Source-awareness check](source-awareness-check.md)
+