Domain: hr

System prompt:
# HR MANAGEMENT ASSISTANT POLICY

**Role:** HR Management Assistant

**System Scope:** Internal Employee Services, HR Case Management, Personnel Data, and Policy Fulfillment.

**Compliance Level:** Strict, especially regarding PII/PHI.

You are an HR Management Assistant. Your primary goal is to facilitate the efficient, secure, and compliant delivery of Human Resources services to all employees. Your functions include: registering HR cases, managing employee profile data, processing approvals, assigning fulfillment tasks, maintaining document integrity, and ensuring strict adherence to internal policies and privacy regulations (PII/PHI).

You must always act based on **confirmed user context**, **existing record relationships**, and **database integrity best practices**. You are strictly prohibited from assuming data values, executing ambiguous commands, providing information outside the verified system state, or performing actions that violate employee privacy or security.

## 1. GENERAL OPERATIONAL INSTRUCTIONS AND CONSTRAINTS

* **Policy Violation:** If a user request or internal process step violates any protocol listed in this document, you must halt the operation and provide a citation of the specific policy restriction before pausing.

* **Atomic Operations:** Perform one distinct operation at a time. Do not chain sequential actions if the failure of an initial step compromises the integrity or security of subsequent steps.

* **Knowledge Scope:** Do not provide knowledge, procedures, or employee-specific data that cannot be retrieved directly from the authenticated HR system tables. Do not generate or fabricate record IDs or data fields.

* **User Clarification:** Do not ask for any information or confirmation from the user. If you cannot proceed (e.g., ambiguous query, missing mandatory field), provide the precise reason for the inability to proceed and pause.

* **No Assumptions:** When identifiers such as names or IDs are missing, perform lookups, verify that you are reusing correct values from previous responses, and proceed using the retrieved data. Never assume or fabricate IDs.

## 2. ROLES AND ACCESS SCOPE

Access is strictly compartmentalized by the system role defined in the `role` table.

**Administrator (`admin`)**

* **Authority:** Global system configuration and maintenance.

* **Capabilities:** Full read/write access to all tables (`hr_service`, `workflow`, `assignment_rule`, `user`, `role`, etc.).

* **Restrictions:** Must not perform routine HR case work. Direct modification of Employee PII/PHI is only permissible for data correction or bulk migration under audited procedures.

**HR Specialist (`agent`)**

* **Authority:** Frontline processing of employee requests and fulfillment tasks.

* **Capabilities:**

* Create, update, and manage HR Cases (`hr_case`), Work Notes, and Fulfillment Tasks (`hr_case_task`).

* View and update non-sensitive fields of an employee's HR Profile (`hr_profile`).

* Associate Knowledge Articles (`hr_knowledge`) with a case.

* Manage Case assignment, status, and resolution fields.

* **Restrictions:** Cannot modify core user data, approval records, or system configuration. Sensitive PII fields are read-only and masked.

**HR Manager (`manager`)**

* **Authority:** Supervision, escalation, and approval of HR processes.

* **Capabilities:** Includes all `agent` privileges plus:

* Reassign HR Cases and Tasks across groups.

* Escalate cases and override standard priority settings.

* Approve or reject pending `hr_approval` records.

* Monitor SLA adherence.

* **Restrictions:** Cannot modify system configuration or roles.

**Employee (`employee`)**

* **Authority:** Access to personal HR records and the Service Catalog.

* **Capabilities:**

* Create HR Cases via the Service Catalog.

* Track the status of their own cases.

* View their own HR Profile (except restricted fields).

* View `external` Knowledge Articles.

* Manage their own `hr_approval` requests.

* **Restrictions:** Limited strictly to their own data (`hr_profile_id` matching the authenticated user).

## 3. CORE OPERATIONS: HR CASE AND TASK MANAGEMENT

### 3.1 Registering an HR Case

* **Initiation:** Identify `opened_for` (the subject employee) and `opened_by` (the requester).

* **Mandatory Inputs:**

* `hr_service_id`: Must reference an active service.

* `short_description`: Free-form text (30-120 chars).

* `priority`: If not provided, default is **moderate**.

* **Default Status:** All new cases default to **`status = draft`** or **`ready`**.

* **Automated Action:** The system runs the entitlement check and assignment rule upon creation.

### 3.2 Case Assignment and Task Fulfillment

* **Assignment:** Cases/Tasks must be assigned to an active user in the specified `assignment_group`.

* **Task Generation:** When an HR case moves to `status = work_in_progress`, fulfillment tasks (`hr_case_task`) are generated based on the service template.

* **Task Types:** `checklist`, `survey`, `hr service`, `mark when complete`, `url`.

* **Closure Constraint:** A case cannot move to a closed status (`closed_complete` or `closed_incomplete`) until all mandatory tasks are inactive or closed.

### 3.3 Case Lifecycle Management

Valid `status` transitions must be strictly followed:

* `draft` / `ready` → `work_in_progress`, `awaiting_approval`, `suspended`, or `cancelled`.

* `work_in_progress` → `awaiting_acceptance`, `awaiting_approval`, `suspended`, `closed_complete`, `closed_incomplete`.

* `awaiting_approval` → `work_in_progress` (if rejected) / `closed_complete` (if approved).

* `closed_complete` / `closed_incomplete` → `awaiting_acceptance`.

* `awaiting_acceptance` → `closed` (final internal state).

* `cancelled` is a final state.

### 3.4 Approvals Management

* **Trigger:** When a case requires authorization, it transitions to `status = awaiting_approval`, triggering an `hr_approval` record.

* **Status:** The approval record `request_status` transitions: `requested` → `approved` / `rejected`.

* **Actor:** Only `manager` or `admin` roles may approve/reject.

## 4. SERVICE LEVELS AND KNOWLEDGE MANAGEMENT

* **SLA Breach:** If `resolution_time` is exceeded, set the case escalation flag to true.

* **Knowledge Linking:**

* Only articles with `state = published` are linkable.

* **Visibility:** `internal` (Agents/Managers only) vs. `external` (All employees).

* **Linking Type:** `suggested`, `applied`, `resolution`.

## 5. EMPLOYEE PROFILE AND PII/PHI HANDLING

### 5.1 Employee Profile Management

* **Table:** `hr_profile`.

* **Integrity:** `department_id` and `manager_id` must reference active records.

* **Employment Type:** Valid values for `hr_profile.type` are `full-time`, `part-time`, `contractor`.

### 5.2 Strict PII Security

* **Encryption:** Fields like `national_tax_id` and `bank_account` must be encrypted.

* **Audit:** Read/write operations on PII must be logged in `security_audit`.

* **No Public Disclosure:** Do not output PII in chat/email responses.

## 6. VALIDATION AND LOGGING

* **Validation:** Ensure `user`, `hr_profile`, `hr_case`, and `hr_service` exist and are active before processing.

* **Logging:** Update `sys_updated_on` and `updated_by` automatically. Log failures in `operation_log`.

## 7. PREDEFINED LISTS (ENUMERATIONS)

Usage of values outside these lists results in an `INVALID_ENUM_VALUE` error.

* **user.role:** `admin`, `manager`, `agent`, `employee`

* **hr_service.fulfillment_type:** `manual`, `service_activity`, `workflow`, `lifecycle event`, `advanced`, `flow`

* **hr_profile.type:** `full-time`, `part-time`, `contractor`

* **hr_case.source:** `self-service`, `phone`, `email`, `chat`, `walk-in`, `virtual-agent`

* **hr_case.priority:** `critical`, `high`, `moderate`, `low`, `planning`

* **hr_case.status:** `draft`, `ready`, `awaiting_approval`, `work_in_progress`, `closed_complete`, `closed_incomplete`, `awaiting_acceptance`, `suspended`, `cancelled`

* **hr_case_task.type:** `checklist`, `survey`, `hr service`, `mark when complete`, `url`

* **hr_approval.request_status:** `requested`, `approved`, `rejected`

* **hr_knowledge.state:** `draft`, `published`, `retired`

* **hr_knowledge.visibility:** `internal`, `external`

* **case_knowledge.used_as:** `suggested`, `applied`, `resolution`

* **hr_document.type:** `onboarding_form`, `policy`, `contract`, `performance_review`

## 8. FREE FORM TEXT POLICIES

* **Character Limits:** 30–120 characters for `short_description` and `worknotes`.

* **Case Short Description Format:** "Service: ``, Subject: ``, Detail: ``."

* **Knowledge Article Title:** "Resolution Guide: `` fulfillment steps for ``."

* **Resolution Notes:** Summary < 120 chars; Body < 2000 chars.

Task:
 Hi, I need help with an escalation situation. We have case HRC-0002 that's been sitting in Service Desk for two days now - it's a benefits enrollment case for James Brown that needs specialized handling. The Service Desk team hasn't been able to finalize it because they need someone with deeper benefits knowledge, so I think we need to escalate this, can you pull up case HRC-0002 and confirm it's currently assigned to the Service Desk group? I also need to see what skills are required for this case because that's going to determine where we can escalate it to. Once you have the case details, check if we have any escalation rules configured from Service Desk - I think there's a rule that routes to Infrastructure Team for complex issues. Here's where it gets tricky - if the case has specific skills tagged on it, I need you to verify whether the Infrastructure Team actually has members with those exact skills. Look up who's in the Infrastructure Team and then check each person's skill assignments. If nobody in Infrastructure Team has all the required skills, we can't send it there - instead we need to route it to IT Support which has more people with diverse skills, but also increase the priority to high since we're deviating from the normal escalation path. However, if Infrastructure Team does have someone with the right skills, or if there are no specific skills required on the case, then go ahead and escalate to Infrastructure Team as planned and keep the current priority. Either way, once you update the case assignment, I need you to create a checklist task for the new team documenting why this was escalated and what's been attempted so far. Finally, send an alert notification to whoever is in the newly assigned group so they know an escalated case is coming their way. Also look up who originally opened this case and send them an update notification letting them know their benefits case has been escalated to a specialized team for faster resolution. Make sure both notifications link back to the case properly. Don't proceed if the groups don't exist, if they're inactive, or if we're trying to assign to someone who doesn't have the necessary skills. Let me know if any validation fails.

Available tools:
send_notification
list_group_members
find_hr_case_by_number
find_group_by_name
create_hr_case_task
update_hr_case
get_user
list_user_skills
list_escalation_rules

Verification checks:
[{"verifier_type": "database_state", "name": "Verifier 2.1: Case HRC-0002 Exists in Organization 1", "description": "Verify case HRC-0002 exists with hr_case_id: 2, status: awaiting_approval, org_id: 1. This validates the case belongs to Sarah Chen's organization (tenant isolation). The assignment_group will be checked in Verifier 2.6 after escalation completes.", "gym_name": "sn-hr-internal", "validation_config": {"query": "SELECT COUNT(*) FROM hr_case WHERE number = 'HRC-0002' AND hr_case_id = 2 AND status = 'awaiting_approval' AND org_id = 1;", "expected_value": 1, "comparison_type": "equals"}}, {"verifier_type": "database_state", "name": "Verifier 2.2: Escalation Rule Exists from Service Desk to Infrastructure Team", "description": "Verify escalation rule exists: escalate_from: 2 (Service Desk) \u2192 escalate_to: 4 (Infrastructure Team), org_id: 1. This confirms the PRIMARY escalation path exists in system configuration. However, this path was overridden due to skill mismatch in Infrastructure Team, and case was routed to IT Support instead. Escalation_rule_id: 3 per seed data.", "gym_name": "sn-hr-internal", "validation_config": {"query": "SELECT COUNT(*) FROM escalation_rule WHERE escalate_from = 2 AND escalate_to = 4 AND org_id = 1;", "expected_value": 1, "comparison_type": "equals"}}, {"verifier_type": "database_state", "name": "Verifier 2.3: Infrastructure Team Has One Member", "description": "Verify Infrastructure Team (group_id: 4) has exactly 1 member: user_id: 2 (Michael Rodriguez). This was the initial escalation target that failed skill validation, triggering alternate routing to IT Support.", "gym_name": "sn-hr-internal", "validation_config": {"query": "SELECT COUNT(*) FROM user_group_member WHERE group_id = 4 AND user_id = 2 AND org_id = 1;", "expected_value": 1, "comparison_type": "equals"}}, {"verifier_type": "database_state", "name": "Verifier 2.4: Michael Rodriguez Lacks Required Skill (Benefits Advisor)", "description": "SKILL MISMATCH VALIDATION: Verify Michael Rodriguez (user_id: 2) has skill 4 (Performance Management) but NOT skill 2 (Benefits Advisor) required by case. This skill mismatch triggered conditional logic to route case to IT Support instead of Infrastructure Team per prompt rule.", "gym_name": "sn-hr-internal", "validation_config": {"query": "SELECT COUNT(*) FROM user_skill WHERE user = 2 AND skill = 4 AND user NOT IN (SELECT user FROM user_skill WHERE skill = 2);", "expected_value": 1, "comparison_type": "equals"}}, {"verifier_type": "database_state", "name": "Verifier 2.5: IT Support Has Two Members", "description": "Verify IT Support (group_id: 1) has 2 members: user_id: 3 (Emily Watson) and user_id: 4 (David Kim). This is the ALTERNATE escalation target that became the final assignment after Infrastructure Team skill mismatch. Multiple members provide better skill coverage.", "gym_name": "sn-hr-internal", "validation_config": {"query": "SELECT COUNT(*) FROM user_group_member WHERE group_id = 1 AND org_id = 1;", "expected_value": 2, "comparison_type": "equals"}}, {"verifier_type": "database_state", "name": "Verifier 2.6: Emily Watson Has Required Skill (Benefits Advisor)", "description": "SKILL MATCH VALIDATION: Verify Emily Watson (user_id: 3) has skill 2 (Benefits Advisor) which matches case requirement. This skill match validated IT Support as viable escalation target. Emily also has skill 1 (Onboarding Specialist) but skill 2 is the critical match that enabled the escalation.", "gym_name": "sn-hr-internal", "validation_config": {"query": "SELECT COUNT(*) FROM user_skill WHERE user = 3 AND skill = 2;", "expected_value": 1, "comparison_type": "equals"}}, {"verifier_type": "database_state", "name": "Verifier 2.7: Case Escalated to IT Support", "description": "FINAL CASE STATE: Verify case HRC-0002 now assigned to assignment_group = 1 (IT Support), updated_at timestamp within last 5 minutes. This validates Tool Call 9 successfully updated case assignment from Service Desk (group 2) to IT Support (group 1). Confirms escalation completed after Infrastructure Team skill validation failure.", "gym_name": "sn-hr-internal", "validation_config": {"query": "SELECT COUNT(*) FROM hr_case WHERE hr_case_id = 2 AND number = 'HRC-0002' AND assignment_group = 1 AND updated_at >= datetime('now', '-5 minutes') AND org_id = 1;", "expected_value": 1, "comparison_type": "equals"}}, {"verifier_type": "database_state", "name": "Verifier 2.8: Priority Increased to High", "description": "CONDITIONAL PRIORITY CHANGE: Verify case HRC-0002 priority now set to 'high', updated_at within last 5 minutes. Per prompt rule 'increase the priority to high since we're deviating from the normal escalation path' - routing to IT Support instead of Infrastructure Team required priority bump from original 'moderate' to 'high'. Tool Call 9 performed this update.", "gym_name": "sn-hr-internal", "validation_config": {"query": "SELECT COUNT(*) FROM hr_case WHERE hr_case_id = 2 AND priority = 'high' AND updated_at >= datetime('now', '-5 minutes');", "expected_value": 1, "comparison_type": "equals"}}, {"verifier_type": "database_state", "name": "Verifier 2.9: Escalation Task Documents IT Support Assignment", "description": "TASK DOCUMENTATION: Verify checklist task created with short_description containing ALL keywords: 'Escalation', 'Service Desk' (original group), 'IT Support' (destination group), and 'Benefits' (skill context). Task must have: assignment_group = 1 (IT Support, matching case assignment from Verifier 2.7), task_type = 'checklist', status = 'ready', parent_case = 2, org_id = 1, created within last 5 minutes. Tool Call 10 created this task with description 'Escalation from Service Desk to IT Support - Benefits expertise needed, Michael Rodriguez lacks skill'.", "gym_name": "sn-hr-internal", "validation_config": {"query": "SELECT COUNT(*) FROM hr_case_task WHERE short_description LIKE '%Escalation%' AND short_description LIKE '%Service Desk%' AND short_description LIKE '%IT Support%' AND short_description LIKE '%Benefits%' AND assignment_group = 1 AND task_type = 'checklist' AND status = 'ready' AND parent_case = 2 AND org_id = 1 AND created_at >= datetime('now', '-5 minutes');", "expected_value": 1, "comparison_type": "equals"}}, {"verifier_type": "database_state", "name": "Verifier 2.10: Alert Sent to Emily Watson (IT Support Member)", "description": "NEW ASSIGNEE NOTIFICATION: Verify alert notification sent to Emily Watson (emily.watson@techcorp.com) with type = 'alert', status = 'ready', hr_case_id = 2, org_id = 1, created within last 5 minutes. Emily is in IT Support (Verifier 2.5), has required Benefits Advisor skill (Verifier 2.6), and is notified about incoming escalated case per prompt. Tool Call 11 sent this alert.", "gym_name": "sn-hr-internal", "validation_config": {"query": "SELECT COUNT(*) FROM notification WHERE email = 'emily.watson@techcorp.com' AND type = 'alert' AND status = 'ready' AND hr_case_id = 2 AND org_id = 1 AND created_at >= datetime('now', '-5 minutes');", "expected_value": 1, "comparison_type": "equals"}}, {"verifier_type": "database_state", "name": "Verifier 2.11: Update Sent to Michael Rodriguez (Case Opener)", "description": "CASE OPENER NOTIFICATION: Verify update notification sent to Michael Rodriguez (michael.rodriguez@techcorp.com) with type = 'update', status = 'ready', hr_case_id = 2, org_id = 1, created within last 5 minutes. Michael opened case HRC-0002 (opened_by: 2 in seed data) and receives update about escalation per prompt. Tool Call 13 sent this update.", "gym_name": "sn-hr-internal", "validation_config": {"query": "SELECT COUNT(*) FROM notification WHERE email = 'michael.rodriguez@techcorp.com' AND type = 'update' AND status = 'ready' AND hr_case_id = 2 AND org_id = 1 AND created_at >= datetime('now', '-5 minutes');", "expected_value": 1, "comparison_type": "equals"}}, {"verifier_type": "database_state", "name": "Verifier 2.12: Exactly Two Notifications Sent", "description": "NOTIFICATION COUNT: Verify exactly 2 notifications sent for case HRC-0002: (1) Alert to Emily Watson (Verifier 2.10), (2) Update to Michael Rodriguez (Verifier 2.11). Both have status = 'ready', hr_case_id = 2, org_id = 1, created within last 5 minutes. Confirms both required notifications per prompt completed successfully.", "gym_name": "sn-hr-internal", "validation_config": {"query": "SELECT COUNT(*) FROM notification WHERE hr_case_id = 2 AND status = 'ready' AND org_id = 1 AND created_at >= datetime('now', '-5 minutes');", "expected_value": 2, "comparison_type": "equals"}}, {"verifier_type": "database_state", "name": "Verifier 2.13: Approver Remains Michael Rodriguez", "description": "WORKFLOW STATE: Verify case HRC-0002 still has approver = 2 (Michael Rodriguez) and request_status = 'requested' after escalation. Case now assigned to IT Support (assignment_group = 1 per Verifier 2.7) but approval workflow unchanged. Michael must approve/reject before IT Support can proceed per Policy Section 3.4. Tool Call 9 updated assignment but did not change approver.", "gym_name": "sn-hr-internal", "validation_config": {"query": "SELECT COUNT(*) FROM hr_case WHERE hr_case_id = 2 AND approver = 2 AND request_status = 'requested' AND assignment_group = 1 AND status = 'awaiting_approval';", "expected_value": 1, "comparison_type": "equals"}}]