# Emergent Security — Intent

Coordination domain: `netkingdom`.
Statehub placement: domain `communication`, topic `netkingdom`.

Enable maximum local autonomy consistent with the guarantees actually owed.
Delegate understood decisions into explicit, testable risk envelopes; escalate
unresolved decisions without expanding privilege; keep platform-root under human
control. As evidence and decision maturity grow, routine work should need fewer
manual approvals without weakening security or tenant guarantees.

## Purpose and audience

Provide the security governance canon and executable policy reference for coding
agents, repository and domain maintainers, and platform and tenant governance
owners. Make it clear who may decide which effects, within what scope and risk,
with which evidence, and where an unresolved decision must go.

## Repository scope

- Maintain the versioned architectural canon in `specs/emergent-security-0.8.md`
  and its self-contained agent extract in `emergent-security-agent.md`.
- Express the default delegation envelope, ordinal risk scales, and illustrative
  platform and tenant governance envelopes as reviewable YAML policy data.
- Provide a small, pure Python reference decision function that evaluates scope,
  prohibitions, root requirements, delegations, tenant bounds, negative memory,
  evidence, risk, and reserved human decisions in a defined order.
- Preserve executable fixtures for autonomous decisions, obligations, denials,
  escalations, root authorization requirements, and tenant governance validation.

The current implementation is a reference library and policy fixture suite. The
canon also describes future integration seams for intent storage, delegation
registries, credential brokering, enforcement, observation, and audit; this
repository does not currently implement those operational services.

## Constraints to preserve

- Identity, available credentials, readable context, and successful precedent do
  not confer authority. Agents cannot authorize their own privilege expansion.
- Deterministic systems decide and enforce effects. Models may reason and
  propose, but are not security boundaries. The reference decision function stays
  deterministic, free of side effects, and independent of model calls.
- Applicable prohibitions prevail over grants. Platform-root produces
  `ROOT_AUTHORIZATION_REQUIRED`; it is never autonomously granted or activated.
- The default autonomous envelope applies only to L0 agents on explicit human
  tasks in a HOT build estate outside tenants. Other scopes require explicit
  delegation; constitutional restrictions continue to apply everywhere.
- Tenant governance may only narrow the platform tenant envelope. Exceeding the
  platform envelope routes to the platform; tenant-reserved human decisions
  cannot be silently approved by automation or timeout.
- Missing scope, delegation, evidence, or acceptable risk produces an explained
  escalation. Unclassified or unknown risk values fail safe. Applicable negative
  memory blocks routine autonomy until resolved.
- Privilege is scoped and leased, decisions remain attributable, and evidence of
  authority use must survive that authority. Learning proposes policy changes;
  it does not grant permissions.

## Evolution and success

Keep policy, canon, agent guidance, and fixtures aligned. Start policy changes
with a failing decision fixture, change policy data where possible, and change
the evaluator when the intended semantics require it. Preserve deterministic
results, unmodified inputs, registry-order independence, and tenant narrowing
invariants.

Harden a zone when real consumers, data, contracts, or recovery costs require
guarantees. Revisit structure through explicit, bounded governance when it
creates needless friction; temperature changes never relax the constitution or
parent guarantees.

Success means more routine decisions resolved safely at the lowest sufficient
scope, fewer repeated escalations and root interventions, less standing
privilege, and clear evidence for every decision. This intent describes the
repository's purpose; it does not itself grant operational authority or replace
the canon and applicable delegation envelopes.