Security Zero Trust

This policy establishes the foundational default-deny posture for any agent that holds tool authority — the right to invoke connectors, write records, send communications, or spend money.

Builds on: s1-operating-context-canvas

This spec defines the structural permission model for agents with tool authority: the principal taxonomy, role definitions, least-privilege assignment rules, tool-scope boundaries, and sensitive-data authorization ceilings.

Builds on: t8-zero-trust-assumptions

This spec defines the sensitive-data classification scheme, the rules governing when data of each class may move between contexts, the detection and blocking controls for prompt-injection and malicious-retrieval attacks, and the access-logging obligations that feed s3-provenance-metadata-schema.

Builds on: t8-permission-architecture, s3-provenance-metadata-schema

This matrix is the runtime permission table for every tool invocation an agent may attempt.

Contract: Produces C10 → Reliability + Provenance

Builds on: t8-permission-architecture, s1-threshold-escalation-spec

This spec defines the safety controls applied to each action_class — the six categories by which tool calls are classified in the tool allow-list.

Builds on: t8-tool-use-control-list, s1-threshold-escalation-spec

This playbook operationalizes the detection, response, and postmortem loop for security events in agents that hold tool authority.

Builds on: t8-tool-use-control-list, s1-monitoring-rollout-postmortem

Six fillable scaffolds for deploying a complete zero-trust security posture on an agent with tool authority.

Builds on: t8-zero-trust-assumptions, t8-permission-architecture, t8-tool-use-control-list, t8-data-leakage-prevention, t8-action-safety-boundaries, t8-monitoring-incident-handling