cyber-authorization · diff
git:20260929.bdf124b to git:20261026.92d06c4
15 added, 14 removed. Audit A to A.
---
name: cyber-authorization
guardrail: true
description: Validates cyber exercise authorization, scope, exclusions, runtime controls, expiry, stop and restart gates. Use when planning or reviewing authorized security activity, scope drift, or unsupported execution environments.
metadata:
labels: [cybersecurity, authorization, runtime-boundary]
triggers:
keywords: [exercise authorization, rules of engagement, scope drift, authorization expiry, runtime controls, stop condition]
---
# Cyber Authorization
## **Priority: P0 (CRITICAL)**
Gate live action with documented authority and host-enforced controls; keep offline planning available.
## Structure
```text
cyber-authorization/
├── SKILL.md
├── references/runtime-authorization-matrix.md
└── evals/evals.json
```
- ## Workflow
-
- 1. Classify request: offline planning, evidence review, or live action.
+ 1. Classify request mode (`analysis`, `replay`, `isolated-lab-validation`, `defensive-verification`) and effects: `active: true` for any interaction outside supplied-artifact reasoning (reading supplied events/files without host mutation is non-active analysis).
2. Resolve authorization record: `engagement_scope_ref`, accountable owner, approved actions, exclusions, window, stop/restart terms.
- 3. Confirm runtime support for tools, credentials, filesystem, network, logging, and cancellation.
- 4. Recheck expiry, exclusions, target identity, and scope drift immediately before each live action.
- 5. Stop on expiry, drift, missing control, unsafe data, or operator stop; record reason and time.
- 6. Restart only after a fresh gate and explicit restart authority.
-
+ 3. Confirm host runtime capability proofs for disposable isolation, tools, credentials, filesystem, network, logging, and cancellation.
+ 4. Evaluate fresh ActionRequest and emit GateDecision immediately before each active action; verify bound target and fixture revision.
+ 5. On pre-dispatch failure, set `blocked`; on running drift, control loss, or operator stop, transition to `stopped` with recorded partial receipts.
+ 6. Run cleanup under surviving teardown authority; restart requires explicit authority, reconciled residual boundary, fresh proofs, and new attempt with fresh gate.
## Rules
- - Unsupported runtime blocks live action; it never blocks safe offline analysis or plan drafting.
- - Markdown records intent; host runtime enforces permissions, credentials, network, filesystem, and cancellation.
+ - Active effects require fresh host capability proofs; reading supplied synthetic events or files without host collection/mutation is non-active analysis and is never blocked by live runtime prerequisites.
+ - Mode never overrides effects classification: active defensive verification or service replay requires the same host gates as lab testing.
+ - Host enforces constraints continuously. Pre-dispatch failure is `blocked`; running failure, drift, or stop transitions to `stopped` (never merely `blocked`).
+ - Pre-action gate recheck immediately before every active action; no long-lived engagement-wide authorization cache is valid.
+ - Lost acknowledgement halts dispatch to reconcile unknown in-flight effects; automatic active replay is strictly prohibited.
+ - Restart requires explicit restart authority, reconciled residual boundary, fresh host proofs, and new attempt ID/gate; fresh GateDecision alone is insufficient.
+ - Markdown records intent; host runtime enforces isolation, permissions, credentials, network, filesystem, and cancellation.
- Gate production changes independently; no operator self-approves promotion.
- - Treat credentials, real targets, malware, exfiltration, and destructive commands as out of scope here.
- - Carry shared evidence fields from [cyber-evidence](../cyber-evidence/SKILL.md).
- Evidence record uses `engagement_scope_ref`, `skill_version`, `source`, `observed_at`, `finding_status`, `evidence_refs`, `limitations`, and `accountable_owner`.
-
+ - Treat real credentials, production/public targets, live malware, exfiltration, and destructive commands as strictly out of scope.
+ - Carry shared evidence fields from [cyber-evidence](../cyber-evidence/SKILL.md) and use [canonical lab execution gate](../cyber-lab-validation/references/execution-gate.md).
## Anti-Patterns
- **No implied consent**: A ticket, chat, or plan is not authorization.
- **No stale scope**: Do not continue after expiry or scope drift.
- **No unsupported execution**: Plan safely; block live action when controls are absent.
- **No self-approval**: Separate requester, operator, and approver roles.
## References
- [Runtime and authorization matrix](references/runtime-authorization-matrix.md)
+ - [Lab execution gate](../cyber-lab-validation/references/execution-gate.md)
- [Evidence record](../cyber-evidence/references/evidence-record.md)