21 lines
1.2 KiB
Markdown
21 lines
1.2 KiB
Markdown
|
# Building security infrastructure
|
||
|
|
|
||
|
|
ops-mason owns construction planning: describe the required route, compare
|
||
|
|
existing structure, review a concrete plan, render the human decision, then build
|
||
|
|
only within the accepted plan. ops-warden routes needs to that construction path.
|
||
|
|
|
||
|
|
Its current owner declaration records a founder-accepted plan-approval exception
|
||
|
|
for specific structure-only effects, not access-engine-based conformance and not
|
||
|
|
permission for new classes of effects. Revalidate the exact declaration and
|
||
|
|
decision before work. Do not attach an invented fail-closed PDP stance to a path
|
||
|
|
that does not consult the PDP.
|
||
|
|
|
||
|
|
The build-mode directive authorizes fixing incomplete/misrouted controls within
|
||
|
|
the task's scope. It is not a general exception to human decisions, production
|
||
|
|
change authorization, secret handling, or harness permissions. Record each
|
||
|
|
relaxation and unarmed control in the owned close-down process with its re-arm
|
||
|
|
condition. Scope or policy conflicts require a concrete decision, not an agent
|
||
|
|
patching policy to authorize itself. This package does not execute construction.
|
||
|
|
|
||
|
|
Source owner IDs (cite the relevant owner, not an invented umbrella): `ops-mason`, `ops-warden`, `the-custodian`.
|