Work with OpenTraces workflow-built datasets. Use `ot_dataset` to list/status/dry-run. Do not publish or configure remotes without explicit user approval. Workflows declare a `security:` contract in their front matter (required, optional, default-enabled, disallowed tools), and each dataset carries a resolved per-dataset security policy seeded from that contract, managed with `opentraces dataset security <name>`. A dataset contract may only use row-applicable tools (`regex`, `entropy`, `privacy_filter`, `business_logic`, `path_anonymizer`); the others (`trufflehog`, `llm_pii`, `capsule_scope`, `classifier`) are rejected at `dataset new`. Required security tools cannot be disabled without `--unsafe-override`, and a row missing them is blocked at publish.