Content policy

Controller of personal data

[PLACEHOLDER: controller of personal data, a legal entity named by the owner]

Grievance contact

[PLACEHOLDER: grievance officer name and contact, supplied by the owner or counsel]

Data residency

[PLACEHOLDER: data residency statement, written by the owner or counsel]

Effective date: [PLACEHOLDER: effective date of this policy].

What may be listed

A listing is a genome pack: an AGF genome that holds rules for how an agent behaves, written in plain language by the person who submits it. Typical genes set a tone, require an approval, name who reviews what, or describe how a business works. Every gene is one explicit statement that a person can read and edit.

A pack holds behaviour, not data. It should work for any business of the kind it describes.

What may not be listed

• Personal data. Names, email addresses, phone numbers, ID numbers, account or card numbers, or anything that identifies a real person.
• Secrets. Passwords, API keys, tokens, private keys, or database addresses that contain a password.
• Malware, or instructions to cause harm. Genes that tell an agent to damage systems, steal data, deceive people, or hurt anyone.
• Impersonation. Posing as another person, business, Nixtra or IntelliNix, or using words such as “official” without the right to.
• Hateful or harassing content. Content that attacks or demeans people for who they are, or that targets a person for abuse.
• Unlawful discrimination. Rules that treat people differently on grounds the law protects, in hiring, lending, service or anything else.
• Deceptive claims. Guarantees, invented ratings or customer counts, or quality figures that were not measured.
• Regulated advice presented as certified. A pack may help with health, legal, tax, finance or HR work. It must not present itself as approved or certified advice, and it must say a qualified person reviews it before use.
• Other people’s IP. Text, trademarks or material you do not have the right to share.

Packs that involve regulated work show a visible notice, “Review before use by a qualified person”. The notice helps a reader. It does not make a pack safe to use without that review.

Labels

• Starter. Written by Nixtra. An example for a business to edit. It is not a certified product.
• Community. Submitted by someone else and read by a reviewer before listing. The label means it was reviewed, not that Nixtra warrants it.
• Partner. Published by a named organisation. [DECISION: what a partner agreement is, before any pack carries the Partner label].

What is checked before a pack is listed

This describes what exists today. It is a small process run by hand, and it is not a security audit.

1. File checks. The catalog validator checks that the pack follows the pack format, that the genome is valid AGF 1.0, that its digest matches, and that names and descriptions avoid the banned claims.
2. Scan rules. A script (scripts/scan-catalog.mjs) runs the rules below on every pack. It uses fixed patterns and no AI model. A “blocks listing” finding must be fixed. A warning goes to the reviewer.
3. Human review. [PLACEHOLDER: name or role of the person who reviews submissions] reads the listing text and every gene, and decides to list the pack, ask for changes, or decline it.

Build-time scan rules

Rule	If it finds something	What it looks for
secrets	Blocks listing	Cloud and API key shapes, private key blocks, token-like strings, and database addresses that contain a password.
pii	Blocks listing	Email addresses, phone-like numbers, Aadhaar-like and PAN-like numbers, card-like numbers, and execution or user ids.
injection	Blocks listing	Phrases that try to override an agent or send a conversation out, hidden characters, and markup or script tags.
claims	Blocks listing	Marketing claims the site cannot back: guaranteed, proven, certified, a compliance badge, invented ratings, download counts, customers or reviews, percentage gains, and comparisons or benchmarks that were not measured.
regulated	Blocks listing	A health, legal, finance or HR pack that is not marked regulated, or a regulated pack that does not say a qualified person must review it.
identity	Blocks listing	A starter genome that lacks its four identity genes or has a boundaries gene under 40 characters. Impersonation is refused: a false verified flag, “official” on a pack the operator did not publish, a publisher name that borrows this site, its platform or a public body, and genes that tell an agent to pass as a human or a regulator.
links	Warning for the reviewer	Any link that is not https, cannot be parsed, or is not on the allow list (which holds only this site). It does not check that a link is live.
size	Warning for the reviewer	Gene text close to the 400-character limit, or more than 14 genes.

The rules match patterns. They miss things a person would catch, and they can flag harmless text. Passing them does not show a pack is safe, correct or suitable for your business. Read a pack before you install it.

After listing

Anyone can report a pack from its page or from the report page. What happens next is on the takedown page. A pack can be removed at any time, and a publisher who breaks this policy can be refused future listings. How a submission is reviewed is on the submission rules page.

This policy may change. Questions: hello@nixtra.tech.

Open placeholders on this page

• [PLACEHOLDER: effective date of this policy]
• [PLACEHOLDER: name or role of the person who reviews submissions]
• [DECISION: what a partner agreement is, before any pack carries the Partner label]
• [PLACEHOLDER: controller of personal data, a legal entity named by the owner]
• [PLACEHOLDER: grievance officer name and contact, supplied by the owner or counsel]
• [PLACEHOLDER: data residency statement, written by the owner or counsel]