Agent skill · forcedotcom
platform-dsar-policy-manage
Configure, run, and audit DsarPolicy Right-to-Portability exports end to end: author the data map over a subject's related records, resolve a request's subject (email/name/id) to a root-entity record, run an export against an ACTIVE policy (poll a couple of times, then ask before continuing; download once terminal), and read run history. Use when the user needs to set up, edit, execute, or inspect a DsarPolicy or Right-to-Portability (RTP) export, or audit which personal data a policy does not cover yet. TRIGGER when: the user configures a DsarPolicy or RTP data map, authors DsarPolicyPath or DsarPolicyField metadata, runs or exports a subject's portable data, downloads an RTP export file, reviews DsarPolicy run history, or asks what personal data the policy does not cover yet (coverage gap analysis). DO NOT TRIGGER when: the user wants to erase, delete, or remove a subject's records (RTP is portability export, not erasure — this skill deletes nothing), mask sandbox PII, or deploy unrelated metadata.
What it needs
About 12k tokens when loaded.
What this skill does
platform-dsar-policy-manage: DsarPolicy Right to Portability, end to end Operate a DsarPolicy — the metadata driving a Right-to-Portability (RTP) export — across its lifecycle: configure the tree, run an export, audit runs. A DsarPolicy is a read/export map: it names which of a subject's records an export collects. It never deletes anything. The value here is judgment, not XML plumbing. FIRST LINE OF EVERY RESPONSE — do not narrate the skill. Your first output token is work or the answer, never a play-by-play. Do not open with "This is a coverage-gap audit / Workflow D…", "Let me read the skill's guide/mechanics…", "Per rule #1…", or "Let me discover the SOR…". Don't name the workflow, announce which reference files you're about to read, or describe your method before doing it — just start doing it (call the tool) and, when done, present the result. This is load-bearing call #8, stated up front because it governs your very first token. A plain-language sentence about the user's data/org is fine; a sentence about the skill, its workflows, rules, tools, or files is not. Load-bearing calls (get these right or the task fails) These override any leading phrasing in the request. Read them first, every time. Call #1 is the literal first action of every task — before you pick a workflow, before any sf command. 1. Route through the SOR tool FIRST — before any sf/endpoint call, no exceptions. The very first action of every task here — including a trivial read-only "does a policy exist / list the policies" lookup — is to scan this run's available tools for a capability-routing tool exposing discover / describe / dispatch verbs (project-codey / Headless 360 today; any host prefix such as mcp<host>discover; match the verb shape, not a fixed name). If one is present, that is the entry move: discover → describe → dispatch the DsarPolicyManager SOR (owner Privacy Center; isActive gates execute/edit/delete) and reject look-alikes (data mask, generic consent, subject erasure). …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills forcedotcom/platform-dsar-policy-manage