TechXchange Demo: Guidance file for Baseline policy of HR Agent in CPEX

[iamsreec]

Summary

Adds baseline natural-language guidance for the HR CPEX demo agent, defining the initial access-control rules Smith will use to generate the corresponding OPA policy.

Closes: #issue-number

Changes

• Add examples/hr-cpex-demo/smith/guidance.txt with baseline policy rules covering:
  • Role-based access to compensation records (Bob/HR allowed, Alice/Engineer denied)
  • SSN viewing permission and redaction rules (Bob needs view_ssn; Eve is denied and must be redacted pre-execution)
  • Repository access authorization (Alice limited to authorized repos; Bob denied on unauthorized team membership)
  • Data exfiltration guards (no emailing SSNs or previously-accessed sensitive data within a session, with denial logging)
  • Session taint isolation between users even when session IDs are reused
  • Compensation adjustment thresholds (< = $10,000 auto-allowed, >$10,000 requires human approval)
  • Blanket rule that unauthorized actions by any named user must be denied before tool execution

Checks

• make ci passes (lint, Rego lint, license headers, build smoke)
• make test passes (policy scorecard — needed if policy behavior changed)
• CHANGELOG.md updated under ## [Unreleased] (if user-facing)
• Commits are signed off for the DCO (git commit -s)

Notes (optional)

Design sketch, screenshots, or extra context.