coulomb/emergent-security
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
emergent-security/knowledge/cards/zones.md
tegwick a835c11ae7 Implement source-backed NetKingdom agent security knowledge pilot 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a101af-e240-7882-a1e3-e37720cbdbea
2026-10-03 15:25:04 +02:00

1.2 KiB
Raw Blame History

Zones, temperature, and environment

zone-engine is retained offline reference conformance for security-zone identity and membership. It provides fixtures, lineage checks, explicit profile projection, and exception checks. It does not expose a live zone API, authorize actions, choose a PEP stance, or place workloads.

Security-zone identity, tenant scope, target environment, and HOT/WARM/COOL/COLD temperature are separate facts. Resolve each from authoritative declarations. Do not infer them from a hostname, repository path, model, or a fixture result. Temperature describes change costs and guarantees, not a permission multiplier. No implicit mapping from a Railiance reef or runtime to a security zone exists.

Use the owner-provided offline manifest and profile only for conformance checks. A proposed live claim mapping remains a gap until its owner publishes it. Missing membership or expired exception evidence must not be repaired by an agent inventing scope or extending a lease. Route the gap to the declaration owner; stance remains with the policy/PEP owner.

Source owner IDs (cite the relevant owner, not an invented umbrella): zone-engine, net-kingdom.