Routines
The routines that need Cresec have three things in common.
They read text someone outside wrote, they can see private data, and they send something out. That combination is what lets a hidden instruction become a leak.
| Routine | Untrusted text in | Private data | Goes out | The attack |
|---|---|---|---|---|
| Support replies | Tickets and emails | Accounts, invoices | Email reply | Send other customers’ invoices to an outside address |
| Sales follow-ups | Prospect emails, call transcripts | CRM deals, pricing notes | Follow-up email | Copy an outside address; quote internal discount limits |
| Recruiting replies | Candidate emails, CVs | Applicant records | Email to the candidate | Attach the shortlist |
| Collections and document chasers | Customer replies | Invoices, payment details | Reminder email | Announce new bank details |
| Call notes to CRM | Call transcripts | CRM records | A CRM update | Mark the deal won or change its owner |
A Cresec tool fixes its actions and recipients in code. An attack that works only through the words of what goes out, such as new bank details in a reminder, is not stopped by any Cresec tool today: a person reviews what goes out.
Routines that never send anything out or never read outside text, such as meeting prep, weekly updates and forecast notes, don’t need Cresec.