# security-canon

Orthogonal vocabulary and canonical model for security-related concepts.

SecurityCanon extends InfoTechCanon with a focused security domain model, in the
same architectural role that [CommerceCanon](../commerce-canon) holds for
commercial terminology and [InterfaceCanon](../interface-canon) for interface
terminology.

Its subject is **architecture, not implementation**: the relationships in which
authority is exercised, described before and independently of the mechanisms
that enforce them. Its first contribution is the **Mode of Authority** vocabulary
— seven auth modes (`USE`, `OBSERVE`, `OPERATE`, `ADMINISTER`, `GOVERN`,
`CONSTRUCT`, `SOVEREIGN`) read relative to a scope. CARING and the access-control
and identity models stay in InfoTechCanon, at the implementation layer and as
shared roots; see [SEC-ADR-001](docs/adr-001-securitycanon-boundary.md).

| | |
| --- | --- |
| **Flavor** | project |
| **Domain** | infotech |
| **Workplan prefix** | `SECURITY-WP-` |
| **Upstream canon** | [InfoTechCanon](../info-tech-canon) |
| **Service surface** | none — reuses InfoTechCanon's |

Start with [INTENT.md](INTENT.md) and [SCOPE.md](SCOPE.md).
Agent instructions are in [AGENTS.md](AGENTS.md); active work is in
[workplans/](workplans/).

| Document | What it holds |
| --- | --- |
| [SEC-ADR-001](docs/adr-001-securitycanon-boundary.md) | the boundary decision — what stays upstream, and why |
| [SEC-ADR-002](docs/adr-002-terminology-separation.md) | the terminology separation — why `AuthorityContext`, not `Subject` |
| [Mode of Authority assessment](history/260920-mode-of-authority-and-canon-structure.md) | review of the v0.1 draft and the proposed canon structure |
| [Actor/Subject implications](docs/260920-actor-subject-implications.md) | the one open terminology question, analysed |

## Status

Draft. The Mode of Authority vocabulary is published as a canon artifact with
machine-readable modes and dimensions; the v0.1 research draft is retained in
`research/` as provenance. Stable promotion needs reviewed mappings and concrete
consumer evidence. See
[SECURITY-WP-0001](workplans/SECURITY-WP-0001-bootstrap-and-vocabulary.md).

## Orientation

| Start here | For |
| --- | --- |
| [Vocabulary card](docs/vocabulary-card.md) | the seven modes and the notation, on one page |
| [Mode of Authority](infospace/vocabulary/mode-of-authority/SecurityCanonModeOfAuthority.md) | the canon artifact |
| [Disambiguation](docs/disambiguation.md) | *operator* or `OPERATE`? role, plane, or mode? |
| [Mapping to InfoTechCanon](infospace/mappings/mode-of-authority-to-infotechcanon.md) | how it relates to the access-control model and CARING |