{"id":"MG-HON-003","category":"honesty","severity":"must","statement":"Booking and intake pages state what the lead must not send before an engagement exists (credentials, codes, private data).","rationale":"Refusing data you cannot protect is both a security control and a trust signal.","applies_to":["booking","assessment-steps"],"machine_checkable":false}