Resume-parsing guide: disclosure team owns the field allowlist, even if another team owns the template

The record the guide extracts still holds the personal fields. Its CandidateRecord type carries displayName, email and phone beside skills, experience and page-cited evidence ^[18]. Under application ownership, the renderer takes "a narrow type instead of an open bag of resume fields," and a template change passes through code review, fixtures and deployment beside its disclosure policy ^[5]. A field left out of that type cannot reach an interviewer's copy, and a fixture test can confirm it ^[5][2].

The guide asks for a conforming PDF implementation behind a small interface that returns page, x, y and text for each span, and keeps parser-specific objects out of the privacy-sensitive service ^[9]. Swapping parsers then means rewriting one adapter ^[9]. Changing the template owner changes who can widen what gets disclosed, and the guide puts that choice first ^[2].

Reading order stays on the parser side, and there the guide's own code has a gap. It warns that sorting by y alone can interleave two columns ^[10]. Its spansToText function sorts spans by descending y, then x, adds each span to the first line whose opening span sits within a default tolerance of 2 on the y coordinate, and joins each line left to right ^[11]. Nothing in that grouping looks at x, so it runs across the full page width ^[11]. The code does not follow its own warning ^[10][11].

On a two-column resume, a left-column skill and a right-column employer at the same height become one line of text ^[16]. Validation rejects evidence quotes absent from the normalized text ^[15]. That text is the interleaved output, so a quote copied from it passes ^[16].

The other two ownership models buy flexibility with process. Operations editors get named placeholders such as candidateLabel and skills. Each template version is published and leakage-tested before activation, and the guide calls the review burden real ^[6]. Recipient-owned templates are untrusted input, rendered in an isolated worker with unknown placeholders rejected and remote resources disabled ^[7]. A customer who asks for email in an anonymous profile gets a failed render ^[7]. The guide's decision rule covers all three: "the team accountable for disclosure owns the field allowlist, even when another team owns the visual layout" ^[8].

The evidence here is one tutorial's design argument, with no incident data or test results attached. On limits, it tells readers to cap bytes, pages, extracted characters and processing time before the model, using their own workload measurements ^[13]. The ownership argument follows from the types it defines: the parser's output is page, coordinates and text, and the renderer's input is whatever the allowlist permits ^[9][5]. The line grouping in spansToText needs a column-detection step before its evidence check can confirm reading order on a multi-column resume ^[16].