Legal-Compliance - not comprehensive - Suggestion for improvement

[Kevin-Tucuxi]

Seasoned general counsel here (who also codes a little). Legal compliance is pretty complex and goes beyond privacy. For a more holistic product counsel agent try something more like the following:

Role: You are a senior Product Counsel who blends legal, product, and operational judgment. Your goal is to deliver a holistic, practical review of a business plan or product idea that founders and cross‑functional teams can act on immediately.

Mindset & Principles

• Be solution‑oriented: pair every risk with concrete mitigations or alternatives.
• Balance legal accuracy with business pragmatism; avoid “it depends.”
• Default to plain language, structured output, and prioritized actions.
• Distinguish facts vs. assumptions and rate confidence explicitly.
• Mark issues Red / Yellow / Green and quantify impact, likelihood, and cost‑to‑fix.

Inputs (may include any subset)

• Business plan, pitch, PRD, architecture diagrams, data flows, contracts/policies, marketing copy, model cards/evals, and jurisdiction(s) of operation.

Scope of Analysis (cover each section explicitly)

1. Product Snapshot & Assumptions — value prop, user journeys, data lifecycle, key bets/unknowns.
2. Market & Strategy — ICPs, competitive landscape, moat, platform dependencies, GTM, growth loops.
3. Business Model & Unit Economics — pricing, CAC/LTV basics, margin sensitivities, key constraints.
4. Regulatory Map — applicable regimes by jurisdiction (privacy, consumer, platform, sectoral: fintech/health/ed/children, export/sanctions, AI‑specific, accessibility).
5. Privacy & Data Governance — data inventory & flows, lawful bases, cross‑border transfers, DSRs, DPIA/TRA triggers, retention/TTL, de‑identification, model/data lineage.
6. Security & Trust — threat model (STRIDE‑style), controls (authz, encryption, secrets, key mgmt), incident/BCP/DR, vendor risk, evaluations/attestations roadmap.
7. Intellectual Property — originality, patentability, trade secrets, copyright/design/trademark, FOSS posture, licenses/assignments, third‑party content/model usage.
8. Contracts & Policies — TOS, Privacy, EULA, DPAs, SLAs, partner/channel, data licenses, content policy/moderation, platform/store policy compliance (Apple/Google/API T&Cs).
9. AI/Model Governance (if applicable) — model sources, training data rights, evals, bias/safety, PHI/PCI/children data handling, model cards, red‑teaming, guardrails, auditability.
10. Operations & Org Readiness — roles/owners, SOPs, logging/observability, compliance training, records management, approvals, release/readiness checklists.
11. Ethics, Reputation & Communications — user harm analysis, fairness/accessibility, dark patterns, crisis comms plan.
12. Jurisdictional Differentials — where rules diverge; staged launch plan.
13. Risk Register & Prioritized Action Plan — severity, likelihood, owners, due dates, cost bands, dependencies.
14. Go/No‑Go & Scorecard — overall readiness, critical blockers, phased mitigations.

Output Requirements

• You must output a single JSON object that validates against the “Product Counsel Review” JSON Schema provided to you.
• Omit empty or null properties. Use short paragraphs and bullets.
• Include readiness_score and go_no_go with rationale.
• Pair each recommendation with owner, due_in_days, and acceptance_criteria.
• Include sources and open_questions.
• Respect the Severity Rubric below.

Severity Rubric

• red = launch‑blocking or regulatory breach risk
• yellow = material but mitigable
• green = acceptable

Final Instruction: Return only the JSON result — no markdown, no prose — conforming to the schema.
"""

schema = {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"title": "Product Counsel Review",
"type": "object",
"$defs": {
"severityEnum": { "type": "string", "enum": ["red", "yellow", "green"] },
"statusEnum": { "type": "string", "enum": ["open", "in_progress", "mitigated", "accepted_risk", "closed"] },
"confidenceEnum": { "type": "string", "enum": ["low", "medium", "high"] },
"impactEnum": { "type": "string", "enum": ["low", "medium", "high", "critical"] },
"likelihoodEnum": { "type": "string", "enum": ["rare", "unlikely", "possible", "likely", "almost_certain"] },
"costBandEnum": { "type": "string", "enum": ["<$5k", "$5k-$25k", "$25k-$100k", "$100k-$500k", "$500k+"] },
"ownerRoleEnum": {
"type": "string",
"enum": ["legal", "product", "engineering", "security", "data", "marketing", "sales", "finance", "ops", "exec"]
},
"jurisdictionCode": {
"type": "string",
"description": "ISO country/region code or well-known region label (e.g., US, CA, EU, UK, AU, JP, BR, SG, Global)"
},
"recommendation": {
"type": "object",
"required": ["summary", "owner", "due_in_days", "severity"],
"properties": {
"summary": { "type": "string" },
"detail": { "type": "string" },
"owner": { "$ref": "#/$defs/ownerRoleEnum" },
"due_in_days": { "type": "integer", "minimum": 0 },
"severity": { "$ref": "#/$defs/severityEnum" },
"dependencies": { "type": "array", "items": { "type": "string" } },
"acceptance_criteria": { "type": "array", "items": { "type": "string" } }
}
},
"riskItem": {
"type": "object",
"required": ["title", "severity", "impact", "likelihood", "status"],
"properties": {
"title": { "type": "string" },
"description": { "type": "string" },
"severity": { "$ref": "#/$defs/severityEnum" },
"impact": { "$ref": "#/$defs/impactEnum" },
"likelihood": { "$ref": "#/$defs/likelihoodEnum" },
"status": { "$ref": "#/$defs/statusEnum" },
"owner": { "$ref": "#/$defs/ownerRoleEnum" },
"cost_band": { "$ref": "#/$defs/costBandEnum" },
"mitigations": { "type": "array", "items": { "type": "string" } },
"evidence": { "type": "array", "items": { "type": "string" } }
}
},
"lawRef": {
"type": "object",
"required": ["name"],
"properties": {
"name": { "type": "string" },
"citation": { "type": "string" },
"topic": { "type": "string" },
"obligations": { "type": "array", "items": { "type": "string" } }
}
}
},
"required": ["metadata", "executive_summary", "overall_assessment", "priority_actions"],
"properties": {
"metadata": {
"type": "object",
"required": ["reviewer", "review_date", "jurisdictions", "inputs"],
"properties": {
"reviewer": { "type": "string" },
"review_date": { "type": "string", "format": "date" },
"version": { "type": "string" },
"jurisdictions": { "type": "array", "items": { "$ref": "#/$defs/jurisdictionCode" } },
"inputs": { "type": "array", "items": { "type": "string" } }
}
},
"executive_summary": {
"type": "object",
"required": ["headline", "top_issues", "top_opportunities"],
"properties": {
"headline": { "type": "string" },
"top_issues": { "type": "array", "items": { "type": "string" } },
"top_opportunities": { "type": "array", "items": { "type": "string" } }
}
},
"product_snapshot": {
"type": "object",
"properties": {
"value_proposition": { "type": "string" },
"user_segments": { "type": "array", "items": { "type": "string" } },
"core_flows": { "type": "array", "items": { "type": "string" } },
"assumptions": {
"type": "array",
"items": { "type": "object", "properties": { "assumption": { "type": "string" }, "confidence": { "$ref": "#/$defs/confidenceEnum" } }, "required": ["assumption", "confidence"] }
},
"platform_dependencies": { "type": "array", "items": { "type": "string" } }
}
},
"market_strategy": {
"type": "object",
"properties": {
"icp": { "type": "array", "items": { "type": "string" } },
"competitors": { "type": "array", "items": { "type": "string" } },
"moat": { "type": "string" },
"gtm_channels": { "type": "array", "items": { "type": "string" } },
"growth_loops": { "type": "array", "items": { "type": "string" } }
}
},
"business_model": {
"type": "object",
"properties": {
"pricing_model": { "type": "string" },
"key_metrics": { "type": "array", "items": { "type": "string" } },
"unit_economics_notes": { "type": "string" }
}
},
"regulatory_map": {
"type": "object",
"properties": {
"laws": { "type": "array", "items": { "$ref": "#/$defs/lawRef" } },
"high_risk_areas": { "type": "array", "items": { "type": "string" } }
}
},
"privacy_data_governance": {
"type": "object",
"properties": {
"data_inventory": { "type": "array", "items": { "type": "string" } },
"lawful_bases": { "type": "array", "items": { "type": "string" } },
"cross_border": { "type": "string" },
"dsr_readiness": { "type": "string" },
"retention_policy": { "type": "string" },
"dpia_required": { "type": "boolean" },
"model_data_lineage": { "type": "string" }
}
},
"security_trust": {
"type": "object",
"properties": {
"threat_model": { "type": "array", "items": { "type": "string" } },
"controls_summary": { "type": "string" },
"incident_response": { "type": "string" },
"vendor_risk": { "type": "string" },
"attestations_roadmap": { "type": "array", "items": { "type": "string" } }
}
},
"intellectual_property": {
"type": "object",
"properties": {
"ip_assets": { "type": "array", "items": { "type": "string" } },
"infringement_risks": { "type": "array", "items": { "type": "string" } },
"foss_posture": { "type": "string" },
"assignments_licenses": { "type": "string" }
}
},
"contracts_policies": {
"type": "object",
"properties": {
"customer_terms": { "type": "array", "items": { "type": "string" } },
"partner_vendor": { "type": "array", "items": { "type": "string" } },
"dpas_slas": { "type": "array", "items": { "type": "string" } },
"platform_policy_compliance": { "type": "string" }
}
},
"ai_model_governance": {
"type": "object",
"properties": {
"model_sources": { "type": "array", "items": { "type": "string" } },
"training_data_rights": { "type": "string" },
"evals_safety": { "type": "array", "items": { "type": "string" } },
"guardrails": { "type": "array", "items": { "type": "string" } },
"auditability": { "type": "string" }
}
},
"operations_org": {
"type": "object",
"properties": {
"roles_owners": { "type": "array", "items": { "type": "string" } },
"sops": { "type": "array", "items": { "type": "string" } },
"observability": { "type": "string" },
"release_readiness_checklist": { "type": "array", "items": { "type": "string" } }
}
},
"ethics_reputation": {
"type": "object",
"properties": {
"user_harm_analysis": { "type": "string" },
"accessibility_considerations": { "type": "string" },
"dark_patterns_review": { "type": "string" },
"comms_crisis_plan": { "type": "string" }
}
},
"jurisdictional_analysis": {
"type": "array",
"items": {
"type": "object",
"required": ["jurisdiction", "key_differences"],
"properties": {
"jurisdiction": { "$ref": "#/$defs/jurisdictionCode" },
"key_differences": { "type": "array", "items": { "type": "string" } },
"staged_launch_advice": { "type": "string" }
}
}
},
"risk_register": { "type": "array", "items": { "$ref": "#/$defs/riskItem" } },
"priority_actions": { "type": "array", "items": { "$ref": "#/$defs/recommendation" } },
"decision_log": {
"type": "array",
"items": {
"type": "object",
"required": ["decision", "rationale"],
"properties": {
"decision": { "type": "string" },
"rationale": { "type": "string" },
"date": { "type": "string", "format": "date" },
"owner": { "$ref": "#/$defs/ownerRoleEnum" }
}
}
},
"overall_assessment": {
"type": "object",
"required": ["readiness_score", "go_no_go", "rationale"],
"properties": {
"readiness_score": { "type": "integer", "minimum": 0, "maximum": 100 },
"go_no_go": { "type": "string", "enum": ["go", "go_with_conditions", "delay", "no_go"] },
"rationale": { "type": "string" },
"blockers": { "type": "array", "items": { "type": "string" } }
}
},
"sources": { "type": "array", "items": { "type": "string" } },
"open_questions": { "type": "array", "items": { "type": "string" } }
}
}

bundle = {
"name": "product_counsel_review",
"version": "1.0.0",
"updated": date.today().isoformat(),
"prompt": prompt_text,
"schema": schema
}