# Security identity, accountable automation and agent orientation review — 2026-10-24

Requested by the founder during NK-WP-0054: review the NetKingdom security infrastructure, optimize the
Service Identity and Privilege standard against the security canon, optimize automation with
accountability, and make the security architecture easy for agents (Claude Code, Codex, Grok) to pick up.

## Method and sources

- Emergent Security orientation: package 0.2.6, digest `8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02`,
  card `start` **withheld** (12 of 14 sources changed since review), so its sources were read directly.
- `security-canon`: README, SCOPE, the Mode of Authority vocabulary card, and the DevOps Secrets Management
  Standard `SEC-DSM` 1.0.0 (sections 4, 9, 20 to 25 read; the rest by heading).
- This repository: `SECURITY-COMPANION.md` (operative form of the accepted security layer model v0.8),
  `canon/standards/`, `AGENTS.md`, `CLAUDE.md`, `tools/`, the `Makefile` and the NK-WP-0054 work.
- Commit history for attribution trailers. No live service, Secret or credential was touched.

## Findings

**R1. The standard restated the canon.** Drafts 1 and 2 of the Service Identity and Privilege standard repeated
SEC-DSM rules (DSM-ID-001/004, DSM-AUTH-001, DSM-HUM-003, DSM-ROOT, DSM-INV, DSM-EXC, DSM-AGENT) and invented
identity "classes" beside the canon's `principal_type` and Mode of Authority. The canon's own translations
contradict one class: "break-glass" is an `activation`, not a kind of identity. They confirm the founder's model:
`backup operator → OPERATE @ backup-system`, `developer → CONSTRUCT @ product`.

**R2. Accountability is present for commits and receipts, absent for hub writes.** Commits carry `Assistant`,
`Assistant-Session` and `Assistant-Process` trailers under the human author. Recovery receipts carry source hashes
and are checked by independent verifiers; admissions are SSH-signed. State Hub progress events and decisions carry a
free-text `author` that nothing authenticates.

**R3. Agents act under the person's ambient authority.** A Claude Code, Codex or Grok session in the founder's
terminal can reach everything the founder's tools reach. SEC-DSM DSM-AGENT-008 counts that as the agent's
authority. There is no per-run agent identity (DSM-AGENT-002). The working practice that kept this safe in
NK-WP-0049 (the agent prepares and tests on fixtures; the person admits and runs; an independent verifier checks)
was not written down as a rule.

**R4. The OpenBao coding-agent role presents as a service.** It binds `principal_type: service`; IAM Profile v0.3
requires `principal_type: agent`. Recorded as finding F-1 in the standard.

**R5. Agents could not find the security tools.** Eleven security tools exist under `tools/`. They were reachable
only through `make help` (over a hundred targets) and per-tool READMEs, with nothing saying which question each
answers or whether an agent may run it. The automatic orientation card is withheld, so a new agent session got no
guided entry. Grok has no dedicated instruction file here; `AGENTS.md` is the shared cross-agent file.

**R6. Overlapping custody material.** `make security-bootstrap-custody-roster-template` prints a two-of-three custody
roster template, and `docs/crisis-custody-list.md` now lists custody items. They should converge rather than drift.

## Changes made

1. **Standard draft-3** (`canon/standards/service-identity-privilege_v0.1.md`, still proposed): an estate profile of
   SecurityCanon. It imports `principal_type` and `MODE @ SCOPE` grants, maps draft-2's classes onto them, states the
   estate identities in canon terms, and gives every rule its SEC-DSM references with only NetKingdom's additions.
   New SI-15, accountable automation, with the golden path prepare, admit, execute, verify, retain. Exceptions now
   carry an elimination path (DSM-EXC-004). Every founder decision and rule id is kept.
2. **Security tools index** (`tools/security-tools.json`, `make security-tools`): every security tool with the
   question it answers, its run and test commands, its governing standard and whether an agent may run it (`yes`,
   `fixtures-only`, `no-attended`, `no-live`). A test fails when a new tool directory is not indexed, or when a path,
   standard or make target in the index does not exist.
3. **Agent quickstart** in `AGENTS.md` and `CLAUDE.md`, identical, in its own marked block beside the managed
   emergent-security pilot block: find the tool, know the rules, route credentials, effective authority, leave a trail.

## Recommendations, with owners

| Item | Owner |
| --- | --- |
| Migrate declarations and validator to grants (NK-WP-0054-T03b) | net-kingdom |
| Authenticate State Hub authorship for agents (actor, session) to meet SI-15 | state-hub |
| Per-run agent identity (DSM-AGENT-002), for example short-lived agent tokens from KeyCape | key-cape, glas-harness |
| Coding-agent role presents as `agent` (F-1) | railiance-platform |
| Refresh the withheld orientation cards; consider a card pointing at `make security-tools` | emergent-security (EMERGENT-WP-0002) |
| Confirm the mode readings in the standard §3, in particular `USE @ directory` for binds | security-canon |
| Converge the custody roster template with the crisis custody list | net-kingdom |
| Confirm which instruction file Grok reads; if not `AGENTS.md`, point it there | founder |