emergent-security/README.md

emergent-security

Adaptive organic security guidance framework. Agents decide what's understood and escalate what isn't. Security that gets more automatic as it matures, with root kept human.# Emergent Security — default envelope

The default delegation envelope of the Emergent Security canon v0.8 (A6) as policy data, the tenant envelopes (B10, B11) as examples, and a small reference decision function (A3) that the fixtures run against.

envelopes/
  scales.yaml                     ordinal risk scales shared by all envelopes
  default-envelope.yaml           A6: what an L0 agent decides alone in a HOT build estate
  examples/
    platform-tenant-acme.yaml     B10: platform-owned outer bound for one tenant
    tenant-governance-acme.yaml   B11: tenant-owned narrowing, self_governed mode
src/emergent_security/            one module per concern (see package docstring)
tests/fixtures/
  decisions/*.yaml                request → expected decision, data only
  tenants/governance-validation.yaml

Run

pip install -e '.[test]'
pytest

Semantics in one screen

• Modes: autonomous, autonomous_with_obligations, escalate, deny, root_authorization_required.
• Variants refine a row by request attributes; first match wins and may replace mode, rules, obligations and evidence.
• deny and root_authorization_required are constitutional: they apply in every scope, including tenants and COLD zones, and no delegation overrides them.
• Every other row applies only where applies_when matches (L0, HOT, build, no tenant).
• escalate means "not delegated here". A registry delegation can grant it (most specific scope wins, ties by id).
• Inside a tenant the default envelope never grants anything. Grants come from the platform tenant envelope or the registry, always bounded by the effective envelope: platform ∩ tenant governance.
• Risk fails safe. A dimension the envelope declares but the request leaves unclassified, or classifies with an unknown value, counts as exceeding.

Changing the policy, test first

1. Add or change a case in tests/fixtures/decisions/*.yaml describing the request and the expected decision. Run pytest; it must fail.
2. Change envelopes/default-envelope.yaml (or an envelope example) until it passes. Touch code only if the canon's semantics changed.
3. Adding an A6 row also means updating A6_CLASSES in tests/test_default_envelope.py and the canon table.

The suite also enforces determinism, idempotency (inputs never mutated, registry order irrelevant), that auto mode equals no tenant configuration, and the G7 tenant invariants.