tegwick
8ab4891043
Insert DevOps Secrets Management Canon v1.0 unchanged, with a placement preface that keeps shared roots upstream. Publish it on the federation card. Assistant: grok Assistant-Session: 01a12ce1-7ded-7e03-a845-2ece8a573af4
58 lines
3.2 KiB
Markdown
58 lines
3.2 KiB
Markdown
# security-canon
|
|
|
|
Orthogonal vocabulary and canonical model for security-related concepts.
|
|
|
|
SecurityCanon extends InfoTechCanon with a focused security domain model, in the
|
|
same architectural role that [CommerceCanon](../commerce-canon) holds for
|
|
commercial terminology and [InterfaceCanon](../interface-canon) for interface
|
|
terminology.
|
|
|
|
Its subject is **architecture, not implementation**: the relationships in which
|
|
authority is exercised, described before and independently of the mechanisms
|
|
that enforce them. Its first contribution is the **Mode of Authority** vocabulary
|
|
— seven auth modes (`USE`, `OBSERVE`, `OPERATE`, `ADMINISTER`, `GOVERN`,
|
|
`CONSTRUCT`, `SOVEREIGN`) read relative to a scope. CARING and the access-control
|
|
and identity models stay in InfoTechCanon, at the implementation layer and as
|
|
shared roots; see [SEC-ADR-001](docs/adr-001-securitycanon-boundary.md).
|
|
|
|
| | |
|
|
| --- | --- |
|
|
| **Flavor** | project |
|
|
| **Domain** | infotech |
|
|
| **Workplan prefix** | `SECURITY-WP-` |
|
|
| **Upstream canon** | [InfoTechCanon](../info-tech-canon) |
|
|
| **Service surface** | none — reuses InfoTechCanon's |
|
|
|
|
Start with [INTENT.md](INTENT.md) and [SCOPE.md](SCOPE.md).
|
|
Agent instructions are in [AGENTS.md](AGENTS.md); active work is in
|
|
[workplans/](workplans/).
|
|
|
|
| Document | What it holds |
|
|
| --- | --- |
|
|
| [SEC-ADR-001](docs/adr-001-securitycanon-boundary.md) | the boundary decision — what stays upstream, and why |
|
|
| [SEC-ADR-002](docs/adr-002-terminology-separation.md) | the terminology separation — why `AuthorityContext`, not `Subject` |
|
|
| [Mode of Authority assessment](history/260920-mode-of-authority-and-canon-structure.md) | review of the v0.1 draft and the proposed canon structure |
|
|
| [Actor/Subject implications](docs/260920-actor-subject-implications.md) | the one open terminology question, analysed |
|
|
|
|
## Status
|
|
|
|
Draft vocabulary, stable secrets standard. The Mode of Authority vocabulary is
|
|
published as a canon artifact with machine-readable modes and dimensions; the
|
|
v0.1 research draft is retained in `research/` as provenance. Stable promotion
|
|
of that vocabulary needs reviewed mappings and concrete consumer evidence. See
|
|
[SECURITY-WP-0001](workplans/SECURITY-WP-0001-bootstrap-and-vocabulary.md).
|
|
|
|
The [DevOps Secrets Management Standard](infospace/standards/devops-secrets-management/SecurityCanonDevOpsSecretsManagementStandard.md)
|
|
(`SEC-DSM` 1.0.0) is the normative secrets-practice guide. Gate House teaches it;
|
|
ops-mason and ops-warden follow it. See
|
|
[SECURITY-WP-0002](workplans/SECURITY-WP-0002-devops-secrets-management-standard.md).
|
|
|
|
## Orientation
|
|
|
|
| Start here | For |
|
|
| --- | --- |
|
|
| [Vocabulary card](docs/vocabulary-card.md) | the seven modes and the notation, on one page |
|
|
| [Mode of Authority](infospace/vocabulary/mode-of-authority/SecurityCanonModeOfAuthority.md) | the canon artifact |
|
|
| [DevOps Secrets Management Standard](infospace/standards/devops-secrets-management/SecurityCanonDevOpsSecretsManagementStandard.md) | the secrets-practice standard (`SEC-DSM` v1.0) |
|
|
| [Disambiguation](docs/disambiguation.md) | *operator* or `OPERATE`? role, plane, or mode? |
|
|
| [Mapping to InfoTechCanon](infospace/mappings/mode-of-authority-to-infotechcanon.md) | how it relates to the access-control model and CARING |
|