Require an ADR for any architectural or cross-team decision

Related rules

From the same buckets as this rule.

• High

  Call out breaking changes explicitly

  If an API/contract or behavior is breaking, add a 'BREAKING CHANGE' section detailing what breaks, migration steps, and affected consumers.

  pr-hygieneapi-contracts-versioning+1
• High

  Capture security and privacy implications

  Add a 'Security & Privacy' section in ADRs addressing threat model impacts, secrets handling, data retention, and PII processing; link to relevant runbooks and DPA if applicable.

  docs-adrssecurity-hardening+2
• High

  De-identify analytics and block PHI egress to third parties

  Any PR that adds or modifies telemetry/analytics must prove that no PHI leaves the boundary. Use irreversible tokenization or hashing (HMAC with secret salt) for identifiers and document the data dictionary.

  compliance-hipaaprivacy-pii+2