net-kingdom/history/2026-10-24-security-identity-and-agent-review.md

Security identity, accountable automation and agent orientation review — 2026-10-24

Requested by the founder during NK-WP-0054: review the NetKingdom security infrastructure, optimize the Service Identity and Privilege standard against the security canon, optimize automation with accountability, and make the security architecture easy for agents (Claude Code, Codex, Grok) to pick up.

Method and sources

• Emergent Security orientation: package 0.2.6, digest 8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02, card start withheld (12 of 14 sources changed since review), so its sources were read directly.
• security-canon: README, SCOPE, the Mode of Authority vocabulary card, and the DevOps Secrets Management Standard SEC-DSM 1.0.0 (sections 4, 9, 20 to 25 read; the rest by heading).
• This repository: SECURITY-COMPANION.md (operative form of the accepted security layer model v0.8), canon/standards/, AGENTS.md, CLAUDE.md, tools/, the Makefile and the NK-WP-0054 work.
• Commit history for attribution trailers. No live service, Secret or credential was touched.

Findings

R1. The standard restated the canon. Drafts 1 and 2 of the Service Identity and Privilege standard repeated SEC-DSM rules (DSM-ID-001/004, DSM-AUTH-001, DSM-HUM-003, DSM-ROOT, DSM-INV, DSM-EXC, DSM-AGENT) and invented identity "classes" beside the canon's principal_type and Mode of Authority. The canon's own translations contradict one class: "break-glass" is an activation, not a kind of identity. They confirm the founder's model: backup operator → OPERATE @ backup-system, developer → CONSTRUCT @ product.

R2. Accountability is present for commits and receipts, absent for hub writes. Commits carry Assistant, Assistant-Session and Assistant-Process trailers under the human author. Recovery receipts carry source hashes and are checked by independent verifiers; admissions are SSH-signed. State Hub progress events and decisions carry a free-text author that nothing authenticates.

R3. Agents act under the person's ambient authority. A Claude Code, Codex or Grok session in the founder's terminal can reach everything the founder's tools reach. SEC-DSM DSM-AGENT-008 counts that as the agent's authority. There is no per-run agent identity (DSM-AGENT-002). The working practice that kept this safe in NK-WP-0049 (the agent prepares and tests on fixtures; the person admits and runs; an independent verifier checks) was not written down as a rule.

R4. The OpenBao coding-agent role presents as a service. It binds principal_type: service; IAM Profile v0.3 requires principal_type: agent. Recorded as finding F-1 in the standard.

R5. Agents could not find the security tools. Eleven security tools exist under tools/. They were reachable only through make help (over a hundred targets) and per-tool READMEs, with nothing saying which question each answers or whether an agent may run it. The automatic orientation card is withheld, so a new agent session got no guided entry. Grok has no dedicated instruction file here; AGENTS.md is the shared cross-agent file.

R6. Overlapping custody material. make security-bootstrap-custody-roster-template prints a two-of-three custody roster template, and docs/crisis-custody-list.md now lists custody items. They should converge rather than drift.

Changes made

1. Standard draft-3 (canon/standards/service-identity-privilege_v0.1.md, still proposed): an estate profile of SecurityCanon. It imports principal_type and MODE @ SCOPE grants, maps draft-2's classes onto them, states the estate identities in canon terms, and gives every rule its SEC-DSM references with only NetKingdom's additions. New SI-15, accountable automation, with the golden path prepare, admit, execute, verify, retain. Exceptions now carry an elimination path (DSM-EXC-004). Every founder decision and rule id is kept.
2. Security tools index (tools/security-tools.json, make security-tools): every security tool with the question it answers, its run and test commands, its governing standard and whether an agent may run it (yes, fixtures-only, no-attended, no-live). A test fails when a new tool directory is not indexed, or when a path, standard or make target in the index does not exist.
3. Agent quickstart in AGENTS.md and CLAUDE.md, identical, in its own marked block beside the managed emergent-security pilot block: find the tool, know the rules, route credentials, effective authority, leave a trail.

Recommendations, with owners

Item	Owner
Migrate declarations and validator to grants (NK-WP-0054-T03b)	net-kingdom
Authenticate State Hub authorship for agents (actor, session) to meet SI-15	state-hub
Per-run agent identity (DSM-AGENT-002), for example short-lived agent tokens from KeyCape	key-cape, glas-harness
Coding-agent role presents as agent (F-1)	railiance-platform
Refresh the withheld orientation cards; consider a card pointing at make security-tools	emergent-security (EMERGENT-WP-0002)
Confirm the mode readings in the standard §3, in particular USE @ directory for binds	security-canon
Converge the custody roster template with the crisis custody list	net-kingdom
Confirm which instruction file Grok reads; if not AGENTS.md, point it there	founder