security-canon/registry/capabilities/capability.security.practice-canon.md

id	owner	status	domain	maturity	external_evidence	name	summary	tags	discovery	availability	relations	evidence	consumer_guidance
capability.security.practice-canon	security-canon	draft	infotech	discovery availability current target confidence rationale D3 D5 medium Owner scope, neighboring responsibilities, concrete use cases and limitations are documented; no exhaustive or generalized maturity claim. current target confidence rationale A0 A0 medium Source interface assessed 2026-10-14: Versioned SEC-DSM and Mode of Authority documents. Availability describes the delivery form, not production acceptance. Normative practice; no runtime control or certification.	completeness reliability level confidence basis C1 low Source artifacts establish a bounded capability; no independent consumer-completeness assessment in this review. level confidence basis R0 low No longitudinal consumer reliability measurement established by this review.	Security practice and authority vocabulary	Versioned SEC-DSM and Mode of Authority documents.	security netkingdom framework-reuse	intent includes excludes use_cases Versioned SEC-DSM and Mode of Authority documents Versioned SEC-DSM and Mode of Authority documents Normative practice; no runtime control or certification U01: Architect composes a security deployment from explicit owner contracts and case types U07: Owner inventories, rotates, revokes and detects exposure of credentials U10: Operator recovers identity, custody or data with independently held recovery material U14: Framework adopter validates and reuses selected contracts, tools and reference compositions	current_level target_level current_artifacts consumption_modes A0 A0 SCOPE.md infospace/standards/devops-secrets-management/SecurityCanonDevOpsSecretsManagementStandard.md informational	related_to capability.security.iam-tooling-suite	documentation SCOPE.md infospace/standards/devops-secrets-management/SecurityCanonDevOpsSecretsManagementStandard.md	recommended_for not_recommended_for known_limitations Architect composes a security deployment from explicit owner contracts and case types Owner inventories, rotates, revokes and detects exposure of credentials Operator recovers identity, custody or data with independently held recovery material Framework adopter validates and reuses selected contracts, tools and reference compositions Normative practice; no runtime control or certification Normative practice; no runtime control or certification 2026-10-14 architecture review estimates operational maturity separately; a registry entry does not authorize execution or establish deployment.

Security practice and authority vocabulary

Versioned SEC-DSM and Mode of Authority documents.

Reuse boundary

Normative practice; no runtime control or certification.

Supported use cases

• U01: Architect composes a security deployment from explicit owner contracts and case types
• U07: Owner inventories, rotates, revokes and detects exposure of credentials
• U10: Operator recovers identity, custody or data with independently held recovery material
• U14: Framework adopter validates and reuses selected contracts, tools and reference compositions

Evidence and integration

• SCOPE.md
• infospace/standards/devops-secrets-management/SecurityCanonDevOpsSecretsManagementStandard.md

Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists.