net-kingdom/history/2026-10-24-security-identity-and-agent-review.md

Security identity, accountable automation and agent orientation review — 2026-10-24

Requested by the founder during NK-WP-0054: review the NetKingdom security infrastructure, optimize the Service Identity and Privilege standard against the security canon, optimize automation with accountability, and make the security architecture easy for agents (Claude Code, Codex, Grok) to pick up.

Method and sources

• Emergent Security orientation: package 0.2.6, digest 8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02, card start withheld (12 of 14 sources changed since review), so its sources were read directly.
• security-canon: README, SCOPE, the Mode of Authority vocabulary card, and the DevOps Secrets Management Standard SEC-DSM 1.0.0 (sections 4, 9, 20 to 25 read; the rest by heading).
• This repository: SECURITY-COMPANION.md (operative form of the accepted security layer model v0.8), canon/standards/, AGENTS.md, CLAUDE.md, tools/, the Makefile and the NK-WP-0054 work.
• Commit history for attribution trailers. No live service, Secret or credential was touched.

Findings

R1. The standard restated the canon. Drafts 1 and 2 of the Service Identity and Privilege standard repeated SEC-DSM rules (DSM-ID-001/004, DSM-AUTH-001, DSM-HUM-003, DSM-ROOT, DSM-INV, DSM-EXC, DSM-AGENT) and invented identity "classes" beside the canon's principal_type and Mode of Authority. The canon's own translations contradict one class: "break-glass" is an activation, not a kind of identity. They confirm the founder's model: backup operator → OPERATE @ backup-system, developer → CONSTRUCT @ product.

R2. Accountability is present for commits and receipts, absent for hub writes. Commits carry Assistant, Assistant-Session and Assistant-Process trailers under the human author. Recovery receipts carry source hashes and are checked by independent verifiers; admissions are SSH-signed. State Hub progress events and decisions carry a free-text author that nothing authenticates.

R3. Agents act under the person's ambient authority. A Claude Code, Codex or Grok session in the founder's terminal can reach everything the founder's tools reach. SEC-DSM DSM-AGENT-008 counts that as the agent's authority. There is no per-run agent identity (DSM-AGENT-002). The working practice that kept this safe in NK-WP-0049 (the agent prepares and tests on fixtures; the person admits and runs; an independent verifier checks) was not written down as a rule.

R4. The OpenBao coding-agent role presents as a service. It binds principal_type: service; IAM Profile v0.3 requires principal_type: agent. Recorded as finding F-1 in the standard.

R5. Agents could not find the security tools. Eleven security tools exist under tools/. They were reachable only through make help (over a hundred targets) and per-tool READMEs, with nothing saying which question each answers or whether an agent may run it. The automatic orientation card is withheld, so a new agent session got no guided entry. Grok has no dedicated instruction file here; AGENTS.md is the shared cross-agent file.

R6. Overlapping custody material. make security-bootstrap-custody-roster-template prints a two-of-three custody roster template, and docs/crisis-custody-list.md now lists custody items. They should converge rather than drift.

Changes made

1. Standard draft-3 (canon/standards/service-identity-privilege_v0.1.md, still proposed): an estate profile of SecurityCanon. It imports principal_type and MODE @ SCOPE grants, maps draft-2's classes onto them, states the estate identities in canon terms, and gives every rule its SEC-DSM references with only NetKingdom's additions. New SI-15, accountable automation, with the golden path prepare, admit, execute, verify, retain. Exceptions now carry an elimination path (DSM-EXC-004). Every founder decision and rule id is kept.
2. Security tools index (tools/security-tools.json, make security-tools): every security tool with the question it answers, its run and test commands, its governing standard and whether an agent may run it (yes, fixtures-only, no-attended, no-live). A test fails when a new tool directory is not indexed, or when a path, standard or make target in the index does not exist.
3. Agent quickstart in AGENTS.md and CLAUDE.md, identical, in its own marked block beside the managed emergent-security pilot block: find the tool, know the rules, route credentials, effective authority, leave a trail.

Recommendations, with owners

Item	Owner
Migrate declarations and validator to grants (NK-WP-0054-T08)	net-kingdom
Authenticate State Hub authorship for agents (actor, session) to meet SI-15	state-hub
Per-run agent identity (DSM-AGENT-002), for example short-lived agent tokens from KeyCape	key-cape, glas-harness
Coding-agent role presents as agent (F-1)	railiance-platform
Refresh the withheld orientation cards; consider a card pointing at make security-tools	emergent-security (EMERGENT-WP-0002)
Confirm the mode readings in the standard §3, in particular USE @ directory for binds	security-canon
Converge the custody roster template with the crisis custody list	net-kingdom
Confirm which instruction file Grok reads; if not AGENTS.md, point it there	founder

Outcome of the owner workers (same day)

Six worker agents, one per repository, were started on the founder's instruction and told to prepare, assess or review only: no live changes, no secrets, no pushes, local commits. Each report was checked against its repository before being relied on. All work is local and unpushed.

Repo	Commits	Result
security-canon	5aa0a64, f844b15	Five mode readings confirmed. Citation errors found and corrected in the standard (SI-1/7 cited anti-patterns, SI-5 rests on a SHOULD, SI-9 should cite DSM-INV-001, SI-15 goes beyond DSM-AUDIT-001). Four canon questions recorded (SECURITY-IN-0002)
railiance-platform	2126457, bca66d1	F-1 and aal2 prepared in source (["service","agent"] transitional; /assurance/level: aal2), rollback written, 7 tests. KeyCape must emit agent first. Nothing applied
key-cape	3acc86f, 7190f5d	Agent tokens feasible with changes. client_credentials agent class 2 to 3 days; delegated agents need RFC 8693 token exchange, 1 to 1.5 weeks
glas-harness	b386b79, 8faa14a	Per-session identity and attribution feasible only for sessions the harness launches
state-hub	0789f9b	Design: Option A, X-Actor-* into an append-only attribution table, labelled claimed/unattributed/legacy
emergent-security	8c903af	Start card 0.2.7 live. An agent re-reviewed 12 sources and resealed it; a human has not reviewed it

Process observation. The emergent-security refresh followed that repository's own procedure, which needs no human signature, yet the card steers every agent session on the machine. The standard's SI-15 asks that agents prepare and people accept. The founder is asked to accept or withdraw the card.

Delegation limits that worked. Telling workers to prepare rather than apply kept the one risky change (role bindings on a live login path) in source with a written rollback. A worker also declined to run fix-consistency where it would have touched another job's uncommitted files.

Draft-4 of the standard applies the security-canon corrections and records the others; no founder decision changed.

Founder decisions, 2026-10-25

• Ratified canon/standards/service-identity-privilege_v0.1.md as v0.1 (status accepted).
• Accepted the emergent-security start card 0.2.7 (commit 8c903af, digest 22b7294e24137c0a350764b9cf37f3d4f2e9f35eb7c97a287d9c89477ef24d7a) after reading the diff of the card text. The acceptance is a human review of an agent-prepared change, recorded here and sent to emergent-security for its EMERGENT-WP-0002 tracking. That commit is still local to that repository and is not pushed by net-kingdom.
• state-hub attribution design (STATE-WP-0100), decided: Option A is phase 1 with no hub_core schema change; correlation by equal session and run id only, no commit verifier (Option B deferred); phase 3 verifies tokens in observe mode once key-cape issues agent tokens, and enforcement is a separate later decision; existing free-text authors are not backfilled (a read-only count may be run later to size a mapping). Hub authorship stays a declared gap in the standard until phase 3.