BrainCAUTION

A framework for building agentic apps

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: brain
description: Work with the Brain institutional-memory template, including importing captures, searching synced Slack and Zoom content, validating quote evidence, and writing knowledge.
---

# Brain Template

Use Brain actions rather than raw SQL.

1. Call `get-brain-settings` before answering, searching broadly, or distilling when current settings are not already in context. Apply the returned guidance for assistant name, company name, tone, source policy, citation requirements, publish tier, redaction, and distillation instructions.
2. Import raw material with `import-capture` (generic), `import-transcript`
   (meeting-shaped: participants, `sourceUrl`, tags), or
   `import-markdown-files` for a bounded Markdown folder/batch. These default
   `enqueueDistillation: true`, immediately create or reuse queue items, and
   auto-create a private `manual` source when `sourceId` is omitted — don't
   call `create-source` first just to import one ad hoc item.
3. Call `enqueue-distillation` when an existing capture needs an explicit
   queue/retry handoff. Re-running it for a capture that's already
   queued/processing refreshes the handoff instructions instead of creating a
   duplicate queue row.
4. Before writing knowledge, call `get-capture` and copy short exact quotes.
   Quotes and offsets always reference the persisted safe capture, never an
   upstream raw payload. `get-capture` redacts `title`/`content`/`metadata` by
   default; `includeRawContent: true` only reveals allowed, source-accessible
   capture content and never bypasses a sensitivity disposition.
5. Call `write-knowledge` with `evidence` entries whose `quote` fields are exact
   capture substrings. `write-knowledge` calls `validateEvidence`, which throws
   if `evidence[].quote` is not found verbatim in the referenced capture's
   content. Copy the quote from `get-capture` output — do not paraphrase, trim
   mid-sentence in a way that changes the substring, or reconstruct it from
   memory.
6. `write-knowledge` publishes directly at its publish tier; there is no manual
   approval step and it never creates a proposal.

## Privacy, Quarantine, And Safe Captures

Every ingest first receives a deterministic sensitivity screen. Performance,
discipline, termination/layoff, compensation, recruiting, health or
accommodation, investigation, privileged legal, credential, and personal-data
signals can only tighten handling; no model or workspace instruction can lower
that boundary.

- `allowed` captures persist safe content and may be indexed immediately. This
  is independent of distillation: semantic coverage must not wait for an agent
  to author a memory.
- `quarantined` or `suppressed` content is unavailable to search, citation,
  distillation, source editors, agent tools, and logs. Review shows only the
  minimal policy metadata needed to operate the queue.
- Re-fetchable providers (Slack, GitHub, Granola) retain metadata-only
  quarantine records. Push-only `generic` and `clips` material is retained only
  in the encrypted, short-TTL private quarantine store; expiry becomes a
  suppression receipt.
- After the deterministic screen, the verdict comes from the classifier named
  by the `privacyClassifier` setting: `jev` (default), `model`, or
  `deterministic`. Jev scores each category as a probability and quarantines
  only when a category scores 0.6 or higher; everything else is stored in full
  apart from the always-on credential, email, phone, and link scrub.
  Jev decides the verdict only — it cannot rewrite a document.
- A Jev failure throws instead of degrading: the sync fails visibly and retries
  on the next hourly run. Only a configured approved-model classifier that
  fails falls back, keeping uncertain captures quarantined.
- If no classifier is reachable, deterministic-only mode allows clearly clean,
  company-relevant material and quarantines uncertainty. Treat the health/setup
  warning as a requirement to configure a classifier before broad ingestion.
- `BRAIN_SENSITIVITY_POLICY_VERSION` stamps new decisions; it does not
  retroactively re-screen. Captures decided under an older policy keep their
  verdict and stay indexed until `resanitize-captures` re-runs them, so treat a
  classifier or policy change as needing a deliberate backfill.

Administrators may review a disposition but may not declassify HR-blocked
evidence. A broader statement must be a newly reviewed, non-identifying memory
with no private quotes, links, or identities.

## Capture Sanitization (Transcripts)

Allowed Slack messages and meeting transcripts are stored in full. Keyword
pre-storage sanitization is opt-in: `shouldSanitizeCaptureBeforeStorage` is
true only when a per-capture `metadata.sanitizeBeforeStorage` or source-config
`sanitizeBeforeStorage` is true, and `captureSanitizationEnabled: false` in
settings turns it off everywhere.

Always, regardless of settings:

- Slack mention/channel encoding, emails, phone numbers, API-key-shaped
  strings, and bare URLs are scrubbed (deterministic regex pass).
- Raw transcript metadata keys (`raw`, `segments`, `transcript`, `messages`,
  `utterances`, `attendees`, `participants`, `speaker(s)`, etc.) are dropped
  from stored `metadata`, not just the text.

When opted in, sanitization also strips recruiting (`RECRUITING_SIGNAL`) and
personal-life (`PERSONAL_SIGNAL`) lines and keeps company-relevant signal
(`COMPANY_SIGNAL`: product, decision, roadmap, pricing, incident, GTM). If nothing
company-relevant survives, the stored content becomes the literal string "No
company-relevant content retained from this capture." — treat that string as
"this capture had nothing worth distilling," not as an error.

## Search: Scoped Hybrid Retrieval

For every company-specific factual question, call `search-everything` (and
`ask-brain` for distilled knowledge) before answering. Answer from their
results, naming the source and date behind each fact. If neither returns
relevant results, say the informati

CAUTIONgrade B · trust 89/100 Install with care. The audit found things worth knowing before you trust its output.

What the source does

Filesystem

none-observed

Network

none-observed

Shell

none-observed

Dependencies

pinned

Secrets in source

none-found

Findings (5)

.agents/skills/an

.agents/skills/content-product-development

.agents/skills/design-exploration

.agents/skills/turn-into-app

.agents/skills/visual-edit

Gates applied: no_behavioural_pass.

[![ModelsAtlas audit: Brain](https://modelsatlas.com/skills/builderio/brain/badge.svg)](https://modelsatlas.com/skills/builderio/brain/)

Not your listing, or something out of date? Claim or update your listing.