01Engagement boundaries
Information use should be limited to the defined engagement purpose, approved team, and agreed tools or environments.
02Client information
Client materials should not appear in public reports, training data, demonstrations, or marketing without explicit authorization.
03Access and retention
Production policy should define access controls, storage locations, retention periods, deletion obligations, and incident handling.
04Expert participation
External experts should be subject to confidentiality, conflict disclosure, and need-to-know access requirements.