# Building security infrastructure

ops-mason owns construction planning: describe the required route, compare
existing structure, review a concrete plan, render the human decision, then build
only within the accepted plan. ops-warden routes needs to that construction path.

Its current owner declaration records a founder-accepted plan-approval exception
for specific structure-only effects, not access-engine-based conformance and not
permission for new classes of effects. Revalidate the exact declaration and
decision before work. Do not attach an invented fail-closed PDP stance to a path
that does not consult the PDP.

The build-mode directive authorizes fixing incomplete/misrouted controls within
the task's scope. It is not a general exception to human decisions, production
change authorization, secret handling, or harness permissions. Record each
relaxation and unarmed control in the owned close-down process with its re-arm
condition. Scope or policy conflicts require a concrete decision, not an agent
patching policy to authorize itself. This package does not execute construction.

Source owner IDs (cite the relevant owner, not an invented umbrella): `ops-mason`, `ops-warden`, `the-custodian`.