Protect
Limit exposure and consequence through least privilege, isolation, safe defaults, bounded input, fail-closed behaviour, and explicit refusal.
Identification
Diagnostic questions
- What is assumed compromiseable or unreliable?
- What consequence must remain outside that boundary?
- What unsafe state must the system refuse outright?
- Which data or capability should never cross the boundary?
In practice
Project Feldspar treats its agent workspace as fully compromiseable and arranges the consequences accordingly. RepoLens has no write path at all, so a tool brought in to diagnose a problem cannot become one. docmend defaults to a dry run and refuses to act on a plan it cannot read.
The recurring move is to decide in advance what is assumed untrustworthy, and then to design so that the assumption being true is survivable rather than catastrophic.
Background threads
Engineered safeguards are the industrial version of this: interlocks, relief paths, and isolation that hold whether or not the operator is having a good day. Risk-control work adds the accounting — which consequence is unacceptable, and what stands between the plant and that consequence.
Common failure
Failing open. When the check cannot run, the system proceeds anyway, so the safeguard is present exactly when it is not needed.