Enrich administrative profiles from SGU

docs/security.md

@@ -30,8 +30,14 @@
 
 ## Profile minimization
 
-- Administrative enrichment reads only employee number, display name,
-  employee type/status, email, job title, and department from known element IDs.
+- Administrative enrichment first verifies the employee number and reads
+  employee type/status, email, job title, and department from the incident
+  overview. Only after that match, it reads given names and paternal/maternal
+  surnames from the personal page plus street, exterior/interior number,
+  neighborhood, locality, state, and postal code from the location page.
+- Administrative birth date, RFC, CURP, sex, blood type, marital status,
+  nationality, telephone, email lists, housing type, and emergency-contact
+  fields are ignored.
 - Student enrichment reads only the matching student number, given names,
   paternal/maternal surnames, email, career, street, neighborhood,
   city/municipality, state, and postal code from known element IDs.
@@ -40,11 +46,13 @@
 - Incident details, calendars, photographs, manager names, and manager positions
   are deliberately ignored.
 - The employee or student number must match the authenticated `AD` or `AL` key
-  before metadata is synchronized.
+  before role-specific metadata is synchronized. The two supplemental
+  administrative pages are never requested unless the incident page supplied
+  the matching employee number.
 - If SGU changes its HTML, authentication and exact-password synchronization
   continue without enrichment; existing AD metadata is not erased.
 - Slow profile pages cannot change an accepted credential into a rejection. The
-  lightweight NTLM root is authoritative; enrichment has its own shorter total
+  lightweight NTLM root is authoritative; enrichment has its own independent total
   timeout.
 
 Lab self-signed certificates are appropriate only for the isolated VM network.