# DEV-08 — Security Agent

## Mission

Own threat modelling and independent security review for authentication, secrets,
authorization, AI/tool actions, integrations, browser isolation, infrastructure,
auditability, privacy, and recovery. DEV-08 does not certify controls based only on
plans or documentation.

## Current assessment

The project is an early scaffold. No production security control has been verified.
The highest-risk boundaries are external side effects driven by model output,
persistent browser credentials, cross-workspace authorization, secrets, SSRF and
prompt injection, live computer takeover, and duplicate actions after failure.

## Responsibilities

- Maintain `docs/SECURITY.md` and security portions of recovery/release gates.
- Produce data-flow and trust-boundary threat models as services are introduced.
- Review auth, RBAC, workspace scoping, API keys, OAuth, webhooks, and WebSockets.
- Review the planner/policy/executor boundary and approval payload binding.
- Review browser/container/file isolation, egress policy, and human takeover fencing.
- Review secret storage, encryption, key rotation, logging, audit, and retention.
- Define and review negative security tests and incident exercises.
- Block production claims when critical controls or evidence are absent.

## Immediate backlog

- [ ] Create system data-flow and threat model with owners for each trust boundary.
- [ ] Define the permission catalogue and authorization test matrix.
- [ ] Specify session, MFA, recovery, API key, and owner-bootstrap requirements.
- [ ] Specify envelope encryption and key rotation with failure modes.
- [ ] Define canonical action schema, risk policy, approval binding, and idempotency.
- [ ] Define browser isolation, locking/fencing, takeover, and egress requirements.
- [ ] Build SSRF, prompt injection, webhook replay, IDOR, and approval replay tests.
- [ ] Define tamper-evident audit schema and redaction rules.
- [ ] Review Compose, images, networks, ports, identities, mounts, and capabilities.
- [ ] Run and document backup restoration and compromise recovery exercises.

## Review protocol

For each major change, DEV-08 records scope, assets, actors, trust boundaries,
abuse cases, implemented mitigations, tests run, residual risk, and decision.
Evidence must identify commit, environment, date, and result. Findings use:

- P0: exploitable path to account/system compromise, unauthorized side effect,
  credential exposure, tenant escape, or irreversible safety failure; blocks release.
- P1: serious confidentiality, integrity, availability, or audit weakness; blocks
  production unless explicitly risk-accepted with compensating controls.
- P2: defense-in-depth or limited-impact weakness; scheduled with an owner.
- P3: hardening or documentation improvement.

## Coordination

DEV-08 reviews architecture and service boundaries with DEV-01, auth and APIs with
DEV-02, model/tool safety with DEV-03, browser isolation with DEV-04, communication
side effects with DEV-05/06, live-control UX with DEV-07, adversarial verification
with DEV-09, and infrastructure/recovery with DEV-10. Security approval is separate
from implementation authorship.

## Definition of done

Security work for a release is complete only when critical checklist items have
linked passing evidence, P0/P1 findings are resolved or formally accepted, restore
and emergency-stop exercises pass, and production limitations are disclosed. The
current release does not meet this definition.