# Customer trust protection rules

Trust compounds; **operational mistakes compound faster**. These rules apply during **execution mode** and ongoing production. They extend [`customer-communication-rules`](../operations/support-sops/customer-communication-rules.md) and rollout trust themes.

## Payroll protection rules

- **Finalized payroll** is immutable by policy: no direct database edits to “fix the UI.” Corrections follow **Finance-approved** processes (adjustment entries, re-runs from correct state, legal/comms if payslips issued).
- **PayrollProtection** (or equivalent) behavior is **product truth**: bypass requests require **Eng + Finance + Legal** where amounts or compliance are affected.
- **Dry-runs and parallel runs** are the pressure valve—not production experimentation on pay day.
- Freeze windows: [`operational-freeze-policy`](../operations/operational-freeze-policy.md).

## Incident transparency expectations

- **Honest status:** unknowns stated; next update time committed and met.
- **Scope:** who was affected and what data/actions were at risk—when confirmed (no speculation).
- **No blame** in customer-facing text; **accountability** internal (owner + date on remediation).
- **Regulatory / contractual** notices: Legal owns wording; engineering supplies technical facts only.

## Communication expectations

- **Single thread** per incident with customer; avoid contradictory channels.
- **No internal jargon** (queue names, stack traces) in customer email.
- **SLA honesty:** do not promise fix times without Eng commander sign-off.
- **After resolution:** short factual summary + what we are doing to prevent recurrence (link to learning loop when appropriate).

## Rollback safety principles

- **Prefer rollback** over forward-fix during payroll freeze or active SEV-2 on same subsystem ([`operational-freeze-policy`](../operations/operational-freeze-policy.md)).
- Rollback plan must include **data** implications (migrations, cached state, idempotent jobs).
- **Verify** one critical path (login, one read, one write) after rollback before broad “all clear.”
- **Document** what was rolled back and ticket linkage for RCA.

## Related

- [`incident-communication-templates`](incident-communication-templates.md)
- [`post-incident-learning-loop`](post-incident-learning-loop.md)
- [`payroll-failure` playbook](../operations/incident-playbooks/payroll-failure.md)