GPT Actions Privacy & Policy Audit
Domain: business_finance — Compliance & Regulatory

Summary: Audit 2,253 real GPT Actions against OpenAI's published GPT Actions Usage Policy and compute cross-domain data-exposure amplification across shared backend domains on a Linux VM.

Task prompt:
You are working on a Linux VM to perform a compliance audit of GPT Actions against OpenAI's published GPT Actions Usage Policy. All inputs are staged locally on this VM. No network access is required or permitted.

## Input Files (read-only)
- Pre-classified Action data: `base/input/pp_action_data_entities.json`
- Data taxonomy (CSV, UTF-8 BOM): `base/input/taxonomy.csv`
- OpenAI GPT Actions Usage Policy + Policy-to-Taxonomy Mapping Guide: `base/input/openai_gpt_actions_usage_policy.md`
- GPT → Action metadata: `base/input/gpt_action_metadata.json`

## Your Task
1. Parse all four input files using only Python 3 standard library modules (`json`, `csv`, `re`, `collections`).
   - If you want to script the audit, use the canonical task-local Python entry point `base/software/python`. It `exec`s the preinstalled system interpreter at `/usr/bin/python`.
2. Apply the Policy-to-Taxonomy Mapping Guide inside the policy markdown verbatim — it is the authoritative mapping from taxonomy `data_type` values to CRITICAL and HIGH violations.
3. Produce `output/policy_violations.json` as a JSON document with `total_violations`, `severity_breakdown` (CRITICAL/HIGH counts), and `violations`: a list with one entry per offending Action field. Each entry must include `severity`, `policy_clause`, `action_domain`, `api_name`, `data_field_name`, and `data_type`. Entries missing `policy_clause` or `action_domain` will be discarded before scoring.
4. Produce `output/cross_domain_exposure_report.csv` with the header `domain,gpt_count,action_count,avg_datatypes_per_action,union_datatypes_count,amplification_factor,union_datatypes`. Include exactly one row for every backend `domain` served by at least 3 distinct GPTs. `amplification_factor` is `f"{round(union_datatypes_count / avg_datatypes_per_action, 3)}x"` (three-decimal numeric prefix plus trailing `x`). `union_datatypes` is a semicolon-delimited, alphabetically sorted list of the distinct `data_type` values.

## Hints
- `taxonomy.csv` begins with a UTF-8 BOM — open it with `encoding="utf-8-sig"`.
- Keys in `pp_action_data_entities.json` are literal `"<domain>, <api_name>"` strings separated by `", "` (comma + single space). Split on the first `", "` only; some `api_name` values contain commas.
- Do not modify any file under `input/`.
- Write only to `output/`.


Required actions:
Parse `pp_action_data_entities.json`, `taxonomy.csv`, `openai_gpt_actions_usage_policy.md`, and `gpt_action_metadata.json` with only Python stdlib modules.
Apply the Policy-to-Taxonomy Mapping Guide verbatim to flag CRITICAL and HIGH taxonomy types per Action field.
Write `output/policy_violations.json` with `total_violations`, `severity_breakdown`, and per-field violation records carrying `severity`, `policy_clause`, `action_domain`, `api_name`, `data_field_name`, and `data_type`.
Write `output/cross_domain_exposure_report.csv` with one row per backend domain served by ≥ 3 distinct GPTs, computing amplification as `round(union_datatypes_count / avg_datatypes_per_action, 3)` suffixed with `x`.

Software: Python (`software/python`)

Input files:
name: pp_action_data_entities.json
format: JSON
description: Pre-classified data collection profiles for 2,253 GPT Actions, keyed by `"<backend_domain>, <api_name>"`. Each Action lists its data fields with an assigned taxonomy `data_type`.
name: taxonomy.csv
format: CSV (UTF-8 BOM)
description: Data taxonomy reference (category, data type, description) used to interpret each field's `data_type`.
name: openai_gpt_actions_usage_policy.md
format: Markdown
description: OpenAI's published GPT Actions Usage Policy with a Policy-to-Taxonomy Mapping Guide that enumerates CRITICAL and HIGH taxonomy types.
name: gpt_action_metadata.json
format: JSON
description: Mapping of 3,116 GPT IDs to their embedded Actions and backend domains, used to compute GPT counts per backend domain.