coulomb/emergent-security
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
emergent-security/knowledge/cards/identity.md
tegwick a835c11ae7 Implement source-backed NetKingdom agent security knowledge pilot 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a101af-e240-7882-a1e3-e37720cbdbea
2026-10-03 15:25:04 +02:00

1.2 KiB
Raw Blame History

Actor, principal, and runtime identity

gate-house's authority-context.v1 distinguishes the principal on whose behalf authority originates, the actor attempting the action, and its concrete runtime identity. Preserve all three. key-cape authenticates; user-engine supplies user and membership facts. The provider/model name is not a principal or a grant.

Request claims include tenant, environment, task, mandate where required, and operating mode. access-engine binds these to authoritative facts. Caller text, memory, available tools, or an agent's summary does not verify a claim. Missing identity or scope goes back to the delegator/identity owner; do not copy another session's credentials. Agent isolation remains distinct from knowledge loading.

SecurityCanon expresses authority as MODE @ SCOPE. USE, OBSERVE, OPERATE, ADMINISTER, GOVERN, CONSTRUCT, and SOVEREIGN describe kinds of authority, not a rank order. BREAK_GLASS is an activation, not a mode. L0–L4 are Emergent decision scopes; there is no automatic numeric mapping to these modes.

Source owner IDs (cite the relevant owner, not an invented umbrella): gate-house, user-engine, key-cape, security-canon, the-custodian.