# Security Requirements for This Project This file encodes security requirements that apply to all code written, reviewed, or suggested in this Claude Code session. These requirements are not advisory: they are mandatory constraints. When you write code, check it against these requirements before presenting it. When you review code, flag any violation as a security finding with severity and remediation guidance. --- ## Secrets: absolute rules **Never** place secrets, credentials, API keys, tokens, passwords, or connection strings in: - Source code or test code - Configuration files tracked in version control - Dockerfiles or container definitions - CI/CD pipeline definitions - Log output or error messages - Environment variable values passed as plain text in container specs **Always** use: - Platform secrets management (key vault, secrets manager) via managed identity - CI/CD platform native secrets mechanisms - `.env` files that are `.gitignored` for local development only If you see a hardcoded secret in existing code, treat it as compromised and flag it immediately as a Critical finding. --- ## Authentication: never implement these - Custom authentication mechanisms or local user stores: always use the organization's designated IdP - MFA bypass paths or fallback authentication without MFA - SAMAccountName-only authentication: use UPN/SSO - Plain LDAP binds on port 389: use LDAPS (port 636) only - Authentication tokens stored in browser `localStorage`: use httpOnly cookies or in-memory - Service accounts with hard-coded passwords: use managed identity or PAM vault injection - Shared secrets for service-to-service calls: use OAuth 2.0 client credentials or managed identity --- ## Input validation: non-negotiable - **Validate all external input server-side**: type, format, length, range. Reject invalid input; do not sanitize and continue. - **Never build SQL, LDAP, XML, or shell commands by string concatenation**: use parameterized queries, ORMs, or prepared statements - **Validate file uploads by content** (magic bytes/MIME detection), not by extension. Store outside web root. Scan before processing. Never execute. - **Context-aware output encoding** for every output context: HTML entity encoding, JSON encoding, URL encoding, SQL quoting --- ## Cryptography: use these, not others | Purpose | Correct Choice | Prohibited | | --- | --- | --- | | Symmetric encryption | AES-256-GCM | DES, 3DES, RC4, Blowfish | | Asymmetric | RSA-4096, EC P-384 | RSA < 4096 | | Key exchange | ECDHE, DHE | Static RSA | | Integrity hashing | SHA-256, SHA-384, SHA-512 | MD5, SHA-1 | | Password hashing | Argon2id (preferred), scrypt, bcrypt (cost ≥12); PBKDF2 (HMAC-SHA-256/512, high iterations) for FIPS-140 contexts | MD5, SHA-anything unsalted (for passwords), plain storage | | TLS | TLS 1.3 (or stronger) | SSL, TLS 1.0, TLS 1.1, TLS 1.2 | | Certificates | SHA-256 RSA or ECDSA | SHA-1 | This table is the minimum baseline. Where the adopting organization's cryptography policy sets a stricter baseline (for example SHA-512 or BLAKE2b-512 for integrity hashing), that policy governs. Never hardcode keys. Keys go in the secrets management service. TLS 1.3 (or stronger) stands as this pack's standalone TLS requirement. An organization that maintains its own encryption and key-management policy aligns this row to that policy's canonical mandate (in the pack's parent GRC corpus, that is `security/policy-encryption-and-key-management.md` §4, Encryption standards). --- ## Authorization - Enforce all authorization server-side on every request: never rely on client-side claims - Default deny: deny unless explicitly granted - RBAC decisions on every call: no implicit allow from previous calls - API responses must not include data the caller is not authorized to receive - Never trust request parameters (IDs, roles, tenant identifiers) without server-side validation against the authenticated identity --- ## Logging and error handling **Never log**: passwords, tokens, session keys, payment data, full PII records, encryption keys **Always log**: authentication events (success and failure), authorization decisions, all access to Confidential/Restricted data, significant configuration changes, all API calls (caller, endpoint, response code, timestamp) **Error responses to callers**: generic message + correlation ID only. Full error details (stack traces, system names, paths, schema details) go to server-side logs only. --- ## CORS Wildcard CORS origins (`Access-Control-Allow-Origin: *`) are prohibited in production APIs, web apps, and HTTP-triggered services. Use an explicit allow-list of permitted origins stored in configuration. --- ## AI and LLM-specific requirements When writing code that calls LLMs, builds AI applications, or processes AI-generated content: - **Treat all LLM output as untrusted user input**: validate and sanitize before use in any downstream operation - **Never pass LLM output directly to**: shell commands, SQL queries, file system operations, or other tool calls without validation - **Implement prompt injection defenses**: do not concatenate user input directly into system prompts; use separate message roles; validate instructions in retrieved content before acting on them - **Rate-limit all AI endpoints**: LLM calls are expensive and can be abused for data exfiltration - **Log AI interaction events and metadata** (request/session id, model, tool calls, human decisions, errors) to SIEM for anomaly detection; log input/output CONTENT only with secrets and PII redacted, and never raw full prompts in production except for an explicitly authorized purpose such as testing or security analysis with the never-log-secrets/PII floor still absolute (consistent with the never-log list above) - **Require human confirmation** before writing to operational data based on AI decisions - **Do not send Confidential or Restricted data to external AI APIs** without a data processing agreement and explicit approval For agentic systems, see additional rules in [`ai/agent-security.md`](ai/agent-security.md). For MCP servers, see [`ai/mcp-security.md`](ai/mcp-security.md). For RAG systems, see [`ai/rag-security.md`](ai/rag-security.md). --- ## Dependencies and third-party code - Verify that AI-suggested dependency names **actually exist** in the package registry before using them: hallucinated package names are a real supply-chain attack vector - Prefer dependencies with: active maintenance (last release within 24 months); compatible licence (Apache 2.0, MIT, BSD generally safe; GPL/AGPL require Legal approval for commercial use); no known Critical/High CVEs - Never install a package from an unverified source or non-standard registry - Review transitive dependencies in SCA output --- ## Data handling - Apply minimum data collection: only collect what is needed for the stated purpose - Do not copy production data to development or test environments: use data masking or synthetic data - Implement data retention logic in application code: delete or anonymize at end of retention period - Log files must not contain unmasked personal data (PII, payment data, credentials) --- ## Development-governance discipline When working on a governed codebase (one with CI gates, audit programmes, branch protections, generated artefacts, or a change-tracking convention), apply the rules in `governance/`. The currently-shipped governance rules are: - [`governance/gate-discipline.md`](governance/gate-discipline.md): never weaken or delete a gate to silence a failure; fix the artefact. Targeted suppressions need a documented rationale on the same line; blanket suppressions are prohibited. Exception path is the project's exception register, not a unilateral suppression. - [`governance/change-tracking.md`](governance/change-tracking.md): every PR carries a CHANGELOG entry, even if terse. Substantive entries record date, version, structured sections (Added/Changed/Removed/Fixed/Security), linked file references, the "why" (not only the "what"), and verification evidence. Terse entries (date + version header + one sentence) cover ancillary changes (internal tooling, working-state housekeeping, pure refactors, typo fixes); there is no skip path. For projects that keep a task backlog, a DONE ledger pairs with CHANGELOG and carries 1-2-sentence headlines, no links: "scrolling battle-text" framing as an at-a-glance index, not a CHANGELOG duplicate. A closed backlog item's DONE entry names the item number and summarizes what the item was and how it was accomplished in one-to-two sentences, and that summary is surfaced in chat at the moment of completion as well. - [`governance/evidence-grounded-completion.md`](governance/evidence-grounded-completion.md): never declare work "done", "fixed", "ready", "shipped", or any synonym, and never assert a factual property of an artefact you have not read (that a file contains, lacks, or requires something), without first running the verification protocol (enumerate files in scope, re-read each in full, quote supporting lines, search for falsifying evidence, distinguish mechanical-gate verification from semantic verification, state unverified items explicitly). The vocabulary of completion, and any state assertion made in research, assessment, planning, or review, are flags that the protocol must precede; the protocol is mechanical so it can be checked without subjective judgement. Accepting an item as unverified (proceeding on it, annotating it unverified-for-now, or relying on a value not confirmed current) rather than resolving it requires recording a durable tracking item in the backlog so it is revisited and verified. Three sharper corollaries apply where the observation is not a single readable file: un-observable state (context depth, a felt sense of doneness) is never assertable and never a wind-down, stop, or defer trigger, which must instead be a named externally-observable signal; inventory, absence, and held-version claims require the collection's own index, not a partial directory look; and external-version currency is answered only by the upstream source verified in the current turn, never a stored note, a cached copy, or a local catalogue (find what is held via the index, verify upstream, act only after both, and never rely on a superseded version without explicit authorization). A stated intention is itself a claim, so an unkept one is a false statement. - [`governance/clarify-before-acting.md`](governance/clarify-before-acting.md): when a request has more than one reasonable interpretation, or an external value the request does not pin down is required to proceed, surface the ambiguity in one sentence and ask before acting. Use sensible defaults only for choices where a wrong guess is bounded to a quick edit; ask before defaulting for choices with consequences beyond this PR (target branch, public API shape, dependency, breaking change). - [`governance/artefact-and-branch-discipline.md`](governance/artefact-and-branch-discipline.md): generated artefacts are read-only (edit the source, run the generator, commit both halves together; CI verifies via `--check` mode); protected branches are append-only (no direct push; no force-push; PR-only merges). The version-monotonicity contract depends on branch protection as its primary defence and the audit as its backstop. - [`governance/action-before-explanation-of-inaction.md`](governance/action-before-explanation-of-inaction.md): never explain why an external action cannot or will not proceed without first attempting it (when safe and reversible) or naming it and asking (when destructive). The trigger surface is the moment a draft contains "X is blocked / waiting on / requires / would fail" attached to an action not attempted this turn; the protocol is the reversibility gate (classify as safe-or-destructive), then the corresponding action (attempt the safe action and report the real result, or name the destructive action and ask). Execution doubt is resolved by trying; decision doubt remains in the clarify-before-acting rule's scope. - [`governance/validate-inference-before-action.md`](governance/validate-inference-before-action.md): when the next action depends on an inferred premise (a state claim not directly observed in the current turn), validate the premise via a tool call before taking the action. Action-side counterpart of the evidence-grounded-completion rule (which is the assertion-side). The trigger surface is the moment a draft contains "since / because / given X, [action]" where X is a state claim that has not been observed in the current turn; the protocol is name-the-inference, cost-the-validation, validate, act-on-the-validated-observation. Cascade failures (one wrong inference driving a chain of wrong actions) are the failure mode the rule prevents. - [`governance/ai-assistant-workflow-disciplines.md`](governance/ai-assistant-workflow-disciplines.md): five disciplines for an AI coding assistant driving multi-PR work over a long session, plus the commit-before-dispatch requirement that any revision-pinned QA or research order have an immutable basis. (1) Research-assistant discipline: workers produce research files, the orchestrator authors all final prose, claims verified at apply-time. (2) Pipeline PR construction: parallel research, serial apply, CI gating between PRs. (3) Apply-time worker correction: catch worker errors at apply-time, document them in the entry. (4) "Always split when in doubt": default to separate PRs unless changes are tightly coherent. (5) Background work during CI waits: read-only prep on the next PR; no edits during the wait. Each discipline emerged from a recurring failure mode during multi-PR remediation work. The rule also carries the layered skeptical pre-push verification standard (not a sixth discipline): tiered by change weight (no standing verifier for quick-fix/bookkeeping; a multi-family cross-family panel pre-push for substantive changes; the full high-assurance harness for sensitive ones), with the validate-fix-re-verify loop (six-iteration cap, nine when unattended and still converging, then defer) and the never-silent override register. - [`governance/trust-recovery-escalation.md`](governance/trust-recovery-escalation.md): the escalation tier invoked when an AI assistant's discipline failures put a maintainer's confidence in a window of work in question. Names the trigger (abbreviated or skipped QA across changes, a skipped verification reaching the shared pipeline, a wrong-cadence automation, an unvalidated inference that cascaded), the two-skill suite (the AI-failure-pattern forensic pass `deep-qa-review` / `/full-qa` first, then the fresh-reader persona pass `library-fitness-review` / `/fitness`), the routing convention (every confirmed finding routed, tiered by severity: High[critical] and High to the top-priority tier, Medium and Low to the next tier, none dropped; apply-time-verified, deduped against the existing backlog), and the sign-off discipline (the tier terminates only on explicit maintainer sign-off, not on an empty finding-set). Includes the full-clone methodology rule: verify a non-shallow clone before any history-aware audit. - [`governance/project-integrity.md`](governance/project-integrity.md): the apex rule of the pack. Fixes the priority ordering on the optimization-dimension axis: **the AIQT Principle, (Accuracy = Integrity = Quality = Trust) > Progress > Speed > Cost**, the four facets forming one non-negotiable co-equal tier, with Progress (decisive advancement) and Speed (latency) the throughput tier below it. Where each other rule constrains a specific behaviour, this rule decides which tier wins when the AIQT tier, progress, speed, and cost conflict (the AIQT tier always, then progress, then speed, then cost; "done faster" and "done cheaper" are never reasons for "done worse"). It re-states the integrity non-negotiables (no stub/mock/fabrication; no gate suppression; no silent changes; failing states surfaced) as the apex-precedence forms of `gate-discipline`, `evidence-grounded-completion`, and `clarify-before-acting`, and prescribes a self-reminder checkpoint at task start, before persistence, before completion claims, and at tension points. - [`governance/surface-counterproductive-instructions.md`](governance/surface-counterproductive-instructions.md): a clear instruction is not automatically a correct one. When following an instruction as given would reduce efficiency, effectiveness, or productivity, lower quality, destroy work already done, contradict a stated goal, or rest on a stale-state belief, stop, consider, and surface the concern with named options before executing, so the requestor can confirm or redirect. The response is stop-consider-confirm (name the concrete cost, offer the better path, ask once, then act on the answer); the charitable-interpretation corollary forbids silently taking a harmful literal reading or reverting committed work without confirming; the calibration keeps it from becoming an over-ask (fire only on material downside, accept an informed override). Requestor-facing counterpart to `clarify-before-acting` (ambiguity) and broader than `project-integrity` (any net-negative effect, not only the AIQT-tier / Progress / Speed / Cost tradeoff). - [`governance/high-assurance-verification.md`](governance/high-assurance-verification.md): the heavier pre-apply verification harness for *sensitive* changes, those that are gate-blind on correctness (a fit or semantic property no existence gate can check), delicate at scale (a wide reshape or bulk mapping where a hand-edit is itself a defect risk), and costly to get wrong (a cited or downstream-relied-on artefact). The five-stage harness: research fan-out; a mechanical signal pass over the negatives (the "open-on-negative-with-signal" discipline); independent adversarial verifiers from two or more model families, blind to each other and to the research, one hunting false negatives (misses) and one hunting false positives (over-assignments); a programmatic invariant floor where mechanical truth exists; and a deterministic scripted apply plus a re-parse, so apply-correctness is independent of the orchestrator's in-context precision. The proactive counterpart to `trust-recovery-escalation` (which is reactive, post-failure); a heavier tier above the routine `ai-assistant-workflow-disciplines` research-assistant flow. Sensitive items persist across sessions in a working-state register surfaced at resume, so the harness recurs to completion rather than being a one-session effort. - [`governance/session-lifecycle.md`](governance/session-lifecycle.md): the session-lifecycle and operating-modes discipline for multi-session AI-assisted work. Six disciplines across the RESUME / WORK / CLOSE phases: a durable handoff record (reconciled not appended, pruned keep-current-plus-one-prior); explicit operator-set operating modes (fully attended, attended-autonomous with green-CI merge authority as the default, unattended with no-idle-stop) that are named never inferred; graceful degradation for blocked operator decisions (a short-timer surface with either a reversible stricter-safe default or defer-and-skip, an absolute reversibility gate so a timeout never auto-executes a destructive action); evidence-gated wind-down (continue is the default; the only valid close trigger is a named externally-observable signal, never felt degradation or work shape); the closing green-merge and its loop-break compensating control (the closing change normally runs its own trailing QA in-change; the narrow fallback skip, only where that QA cannot be made self-contained at the session boundary, pairs with a stronger next-resume whole-scope validation cross-checked against asserted-clean claims); and an advisory concurrency lease. Distilled from the session apparatus of the project this pack was developed in; project-agnostic, so the consuming project wires the concrete files (its own `CLAUDE.md` or equivalent carries the project-specific operationalization). - [`governance/decision-classification-before-enacting.md`](governance/decision-classification-before-enacting.md): before enacting a significant autonomous decision (one that disposes of a queued or authorized item, or bends the plan: a defer, re-sequence, wind-down, skip, or authorial choice made without asking), classify it as exactly one of ACT / ASK / BLOCKED and write the classification BEFORE enacting it, not as an after-the-fact narration. A BLOCKED classification names a blocker-type from a closed, externally-observable set (`maintainer-decision-unreachable`, `irreversible-needs-confirmation`, `failing-check`, `source-unavailable`, `maintainer-directed-hold`); an un-instrumented internal-state justification (heaviness, felt degradation, "do it fresh later") is never a valid BLOCKED reason. Consolidates the write-BEFORE-enact ordering and the closed blocker vocabulary that sat across `action-before-explanation-of-inaction`, `clarify-before-acting`, and `evidence-grounded-completion` but were owned in full by none; a set-completeness BLOCKED claim additionally carries the evidence-grounded-completion enumeration burden and asymmetric-skepticism bar. - [`governance/express-authorization-before-execution.md`](governance/express-authorization-before-execution.md): execution of a plan-initiating unit of work begins only on an express authorization from the responsible authority that NAMES the work; a conceptual or planning discussion is not a go, and a conditional or sequenced go ("do X, then wait, then we proceed") authorizes only its first step until its condition is confirmed. Until an express, work-naming go is given the assistant stays in discussion mode (plans, candidate shapes, questions, never edits, commits, or outward actions). The pause-before-acting family's entry-condition member and the mirror of `decision-classification-before-enacting` (that rule governs not-doing authorized work; this governs beginning not-yet-authorized work); when unsure whether a go covers the work at hand, ask a one-sentence "confirm go on X?" and stay in discussion mode until it is answered. The phased governance rollout announced at pack version 1.6.0 completed at 1.11.0 with the first five rules above. Pack version 1.21.0 added the sixth rule (`action-before-explanation-of-inaction.md`) as a post-rollout extension. Pack version 1.27.0 added the seventh rule (`validate-inference-before-action.md`) after a recurring failure mode where an orchestrator inferred premises (subagent-skip justification, fix-completeness, corpus-state) without validating; each inference cascaded into downstream rework. Pack version 1.36.0 added the eighth rule (`ai-assistant-workflow-disciplines.md`) after observing five distinct memory-only processes the orchestrator was following during multi-PR remediation work; documenting them gave the disciplines durability across sessions. Pack version 1.47.0 added the ninth rule (`trust-recovery-escalation.md`) after a session whose discipline failures (abbreviated QA across eleven changes, a skipped post-commit audit, a wrong-cadence timer) required a structured white-box re-examination of the window; the rule names the escalation suite and the maintainer-sign-off termination that rebuild trust. Pack version 1.49.0 added the tenth rule (`project-integrity.md`), the project-agnostic distribution of the Quality > Speed > Cost apex integrity rule, so adopters inherit the lexicographic priority ordering rather than re-deriving it under pressure. Pack version 1.51.0 added the eleventh rule (`surface-counterproductive-instructions.md`) after a maintainer's brief instruction was read literally and silently, reverting committed work the instruction did not intend to destroy; the rule names the general case (a clear instruction can still be the wrong thing to do) so the assistant surfaces the concrete cost and confirms before acting, rather than complying fast or refusing. Pack version 1.52.0 added the twelfth rule (`high-assurance-verification.md`) after a maintainer-directed sensitive change (adding an AI-control column to a compliance matrix, a wide reshape whose per-cell control-code fit no existence gate can check) was made integrity-absolute through a layered harness that caught real defects a single pass missed; the rule generalizes that harness (independent adversarial verification plus a deterministic apply, persisted across sessions) as the proactive counterpart to `trust-recovery-escalation`. Pack version 1.59.0 added the thirteenth rule (`session-lifecycle.md`), distilling this project's own multi-session apparatus (durable handoff, explicit operator-set operating modes, graceful degradation for blocked decisions, evidence-gated wind-down, the green-merge close with its loop-break compensating control, and a concurrency lease) into a project-agnostic discipline any project running multi-session AI-assisted work inherits; the project `CLAUDE.md` retains the project-specific operationalization. Pack version 1.63.0 added the fourteenth rule (`decision-classification-before-enacting.md`), consolidating the write-before-enact decision rubric and the closed, externally-observable blocker vocabulary (ACT / ASK / BLOCKED) that had sat across `action-before-explanation-of-inaction`, `clarify-before-acting`, and `evidence-grounded-completion` but were owned in full by none; it was earned after plan-bending decisions (defers, wind-down offers) were repeatedly justified on un-instrumented internal state rather than a named, externally-observable blocker. Pack version 1.64.0 added the fifteenth rule (`express-authorization-before-execution.md`), the pause-before-acting family's entry-condition member, after a planning discussion or a conditional go ("deliver X, then we go") was repeatedly read as licence to begin executing work no authority had expressly named; it is the mirror of the fourteenth rule (that rule governs not-doing already-authorized work, this one governs beginning not-yet-authorized work), shipped convention-first with a mechanical GO-ledger-keyed hook deliberately deferred. --- ## Framework basis These requirements implement controls from: - OWASP Top 10:2025 (eighth edition; supersedes 2021) - OWASP LLM Top 10 (2026) - OWASP MCP Top 10 - OWASP ASVS v5.0.0 - NIST SSDF (SP 800-218 and SP 800-218A: Generative AI Profile) - CSA CCM v4.1 / AICM v1.1 - ISO/IEC 27001:2022 Annex A - CISA Secure by Design principles - SLSA v1.2 (Supply-chain Levels for Software Artifacts): Build and Source tracks The pack's governance rules and skills are self-contained as behavioural guidance. The audit toolchain (the parent repo's linters and CI) and the extended requirement detail (`dev-security/standard-developer-security-requirements.md`) live in the pack's parent GRC library and do not ship with the pack, so a project that wants mechanical enforcement or that detail supplies it separately. ## Pinned AIQT baseline GRC owns its legacy publication sources under guardrails/ and its project compatibility requirements. The imported guardrails/aiqt-rules/ snapshot is owned upstream at the commit in vendor/aiqt/RULES.json, equal to vendor/aiqt/PIN.toml. Do not author into that snapshot or publish it back upstream as GRC-authored core. Gate 37 checks pinned source digests and deterministic local adaptations, including scope metadata, and still checks the legacy procedure copies against their pack sources. Gate 83 classifies the publication tree. Read the retained workflow procedure before changing GRC-authored portable content or adapters. - aiqt: [`aiqt-rules/aiqt/00-project-integrity.md`](aiqt-rules/aiqt/00-project-integrity.md); [`aiqt-rules/aiqt/10-ACCUR-citation-from-opened-file.md`](aiqt-rules/aiqt/10-ACCUR-citation-from-opened-file.md); [`aiqt-rules/aiqt/10-ACCUR-claims-rest-on-observation.md`](aiqt-rules/aiqt/10-ACCUR-claims-rest-on-observation.md); [`aiqt-rules/aiqt/10-ACCUR-completeness-claim-enumerates-its-set.md`](aiqt-rules/aiqt/10-ACCUR-completeness-claim-enumerates-its-set.md); [`aiqt-rules/aiqt/10-ACCUR-corroborate-external-claims.md`](aiqt-rules/aiqt/10-ACCUR-corroborate-external-claims.md); [`aiqt-rules/aiqt/10-ACCUR-count-carries-its-predicate.md`](aiqt-rules/aiqt/10-ACCUR-count-carries-its-predicate.md); [`aiqt-rules/aiqt/10-ACCUR-disclose-guard-residuals.md`](aiqt-rules/aiqt/10-ACCUR-disclose-guard-residuals.md); [`aiqt-rules/aiqt/10-ACCUR-evidence-grounded-completion.md`](aiqt-rules/aiqt/10-ACCUR-evidence-grounded-completion.md); [`aiqt-rules/aiqt/10-ACCUR-guard-input-soundness.md`](aiqt-rules/aiqt/10-ACCUR-guard-input-soundness.md); [`aiqt-rules/aiqt/10-ACCUR-measured-and-estimated-figures-stay-separate.md`](aiqt-rules/aiqt/10-ACCUR-measured-and-estimated-figures-stay-separate.md); [`aiqt-rules/aiqt/10-ACCUR-no-fabrication.md`](aiqt-rules/aiqt/10-ACCUR-no-fabrication.md); [`aiqt-rules/aiqt/10-ACCUR-observe-before-asserting-behaviour.md`](aiqt-rules/aiqt/10-ACCUR-observe-before-asserting-behaviour.md); [`aiqt-rules/aiqt/10-ACCUR-partial-read-is-not-the-whole.md`](aiqt-rules/aiqt/10-ACCUR-partial-read-is-not-the-whole.md); [`aiqt-rules/aiqt/10-ACCUR-read-before-characterizing.md`](aiqt-rules/aiqt/10-ACCUR-read-before-characterizing.md); [`aiqt-rules/aiqt/10-ACCUR-reference-capture.md`](aiqt-rules/aiqt/10-ACCUR-reference-capture.md); [`aiqt-rules/aiqt/10-ACCUR-reproduce-before-fix.md`](aiqt-rules/aiqt/10-ACCUR-reproduce-before-fix.md); [`aiqt-rules/aiqt/10-ACCUR-timestamp-from-clock.md`](aiqt-rules/aiqt/10-ACCUR-timestamp-from-clock.md); [`aiqt-rules/aiqt/10-ACCUR-validate-inference-before-action.md`](aiqt-rules/aiqt/10-ACCUR-validate-inference-before-action.md); [`aiqt-rules/aiqt/10-ACCUR-verify-fix-in-commit.md`](aiqt-rules/aiqt/10-ACCUR-verify-fix-in-commit.md); [`aiqt-rules/aiqt/10-INTEG-anything-wrong-fixed-first.md`](aiqt-rules/aiqt/10-INTEG-anything-wrong-fixed-first.md); [`aiqt-rules/aiqt/10-INTEG-attestation-is-harness-owned.md`](aiqt-rules/aiqt/10-INTEG-attestation-is-harness-owned.md); [`aiqt-rules/aiqt/10-INTEG-branch-and-merge-on-green.md`](aiqt-rules/aiqt/10-INTEG-branch-and-merge-on-green.md); [`aiqt-rules/aiqt/10-INTEG-branch-rooted-on-live-main.md`](aiqt-rules/aiqt/10-INTEG-branch-rooted-on-live-main.md); [`aiqt-rules/aiqt/10-INTEG-check-fails-closed-on-unreadable.md`](aiqt-rules/aiqt/10-INTEG-check-fails-closed-on-unreadable.md); [`aiqt-rules/aiqt/10-INTEG-commit-identity.md`](aiqt-rules/aiqt/10-INTEG-commit-identity.md); [`aiqt-rules/aiqt/10-INTEG-explicit-binding-over-ambient-context.md`](aiqt-rules/aiqt/10-INTEG-explicit-binding-over-ambient-context.md); [`aiqt-rules/aiqt/10-INTEG-gate-discipline.md`](aiqt-rules/aiqt/10-INTEG-gate-discipline.md); [`aiqt-rules/aiqt/10-INTEG-generated-artefact-source-only.md`](aiqt-rules/aiqt/10-INTEG-generated-artefact-source-only.md); [`aiqt-rules/aiqt/10-INTEG-licence-compatibility.md`](aiqt-rules/aiqt/10-INTEG-licence-compatibility.md); [`aiqt-rules/aiqt/10-INTEG-no-concealed-failure.md`](aiqt-rules/aiqt/10-INTEG-no-concealed-failure.md); [`aiqt-rules/aiqt/10-INTEG-preserve-uncommitted-work.md`](aiqt-rules/aiqt/10-INTEG-preserve-uncommitted-work.md); [`aiqt-rules/aiqt/10-INTEG-protected-branch-integrity.md`](aiqt-rules/aiqt/10-INTEG-protected-branch-integrity.md); [`aiqt-rules/aiqt/10-INTEG-required-step-remains-required.md`](aiqt-rules/aiqt/10-INTEG-required-step-remains-required.md); [`aiqt-rules/aiqt/10-INTEG-rerun-pass-is-still-failure.md`](aiqt-rules/aiqt/10-INTEG-rerun-pass-is-still-failure.md); [`aiqt-rules/aiqt/10-INTEG-review-in-flight-pins-its-artefact.md`](aiqt-rules/aiqt/10-INTEG-review-in-flight-pins-its-artefact.md); [`aiqt-rules/aiqt/10-INTEG-safe-retries.md`](aiqt-rules/aiqt/10-INTEG-safe-retries.md); [`aiqt-rules/aiqt/10-INTEG-separate-task-changes.md`](aiqt-rules/aiqt/10-INTEG-separate-task-changes.md); [`aiqt-rules/aiqt/10-INTEG-stage-then-promote-on-green.md`](aiqt-rules/aiqt/10-INTEG-stage-then-promote-on-green.md); [`aiqt-rules/aiqt/10-INTEG-track-launched-work.md`](aiqt-rules/aiqt/10-INTEG-track-launched-work.md); [`aiqt-rules/aiqt/10-INTEG-validation-gates-apply.md`](aiqt-rules/aiqt/10-INTEG-validation-gates-apply.md); [`aiqt-rules/aiqt/10-INTEG-workers-produce-inert-data.md`](aiqt-rules/aiqt/10-INTEG-workers-produce-inert-data.md); [`aiqt-rules/aiqt/10-QUALI-absolute-paths.md`](aiqt-rules/aiqt/10-QUALI-absolute-paths.md); [`aiqt-rules/aiqt/10-QUALI-change-carries-check.md`](aiqt-rules/aiqt/10-QUALI-change-carries-check.md); [`aiqt-rules/aiqt/10-QUALI-compatibility-or-migration.md`](aiqt-rules/aiqt/10-QUALI-compatibility-or-migration.md); [`aiqt-rules/aiqt/10-QUALI-confirm-execution-target.md`](aiqt-rules/aiqt/10-QUALI-confirm-execution-target.md); [`aiqt-rules/aiqt/10-QUALI-defence-in-depth-default.md`](aiqt-rules/aiqt/10-QUALI-defence-in-depth-default.md); [`aiqt-rules/aiqt/10-QUALI-elapsed-aware-timer-restore.md`](aiqt-rules/aiqt/10-QUALI-elapsed-aware-timer-restore.md); [`aiqt-rules/aiqt/10-QUALI-findings-are-fixed-not-argued.md`](aiqt-rules/aiqt/10-QUALI-findings-are-fixed-not-argued.md); [`aiqt-rules/aiqt/10-QUALI-goal-fidelity-across-trajectory.md`](aiqt-rules/aiqt/10-QUALI-goal-fidelity-across-trajectory.md); [`aiqt-rules/aiqt/10-QUALI-high-assurance-verification.md`](aiqt-rules/aiqt/10-QUALI-high-assurance-verification.md); [`aiqt-rules/aiqt/10-QUALI-kill-timeout-exceeds-callee-wait.md`](aiqt-rules/aiqt/10-QUALI-kill-timeout-exceeds-callee-wait.md); [`aiqt-rules/aiqt/10-QUALI-lightweight-verifier-workers.md`](aiqt-rules/aiqt/10-QUALI-lightweight-verifier-workers.md); [`aiqt-rules/aiqt/10-QUALI-match-surrounding-code.md`](aiqt-rules/aiqt/10-QUALI-match-surrounding-code.md); [`aiqt-rules/aiqt/10-QUALI-minimize-dependencies.md`](aiqt-rules/aiqt/10-QUALI-minimize-dependencies.md); [`aiqt-rules/aiqt/10-QUALI-self-guardrail-from-error.md`](aiqt-rules/aiqt/10-QUALI-self-guardrail-from-error.md); [`aiqt-rules/aiqt/10-QUALI-smallest-correct-change.md`](aiqt-rules/aiqt/10-QUALI-smallest-correct-change.md); [`aiqt-rules/aiqt/10-QUALI-surface-counterproductive-instructions.md`](aiqt-rules/aiqt/10-QUALI-surface-counterproductive-instructions.md); [`aiqt-rules/aiqt/10-QUALI-test-hermeticity.md`](aiqt-rules/aiqt/10-QUALI-test-hermeticity.md); [`aiqt-rules/aiqt/10-QUALI-verifier-delivery-completeness.md`](aiqt-rules/aiqt/10-QUALI-verifier-delivery-completeness.md); [`aiqt-rules/aiqt/10-QUALI-verifier-diversity.md`](aiqt-rules/aiqt/10-QUALI-verifier-diversity.md); [`aiqt-rules/aiqt/10-TRUST-ai-toolchain-register.md`](aiqt-rules/aiqt/10-TRUST-ai-toolchain-register.md); [`aiqt-rules/aiqt/10-TRUST-assess-advise-discussion-only.md`](aiqt-rules/aiqt/10-TRUST-assess-advise-discussion-only.md); [`aiqt-rules/aiqt/10-TRUST-atomic-claim-from-pool.md`](aiqt-rules/aiqt/10-TRUST-atomic-claim-from-pool.md); [`aiqt-rules/aiqt/10-TRUST-change-record.md`](aiqt-rules/aiqt/10-TRUST-change-record.md); [`aiqt-rules/aiqt/10-TRUST-change-tracking-ext.md`](aiqt-rules/aiqt/10-TRUST-change-tracking-ext.md); [`aiqt-rules/aiqt/10-TRUST-clarify-before-acting.md`](aiqt-rules/aiqt/10-TRUST-clarify-before-acting.md); [`aiqt-rules/aiqt/10-TRUST-concurrency-lease.md`](aiqt-rules/aiqt/10-TRUST-concurrency-lease.md); [`aiqt-rules/aiqt/10-TRUST-continue-by-default.md`](aiqt-rules/aiqt/10-TRUST-continue-by-default.md); [`aiqt-rules/aiqt/10-TRUST-express-authorization-before-execution.md`](aiqt-rules/aiqt/10-TRUST-express-authorization-before-execution.md); [`aiqt-rules/aiqt/10-TRUST-human-oversight-and-autonomy-threshold.md`](aiqt-rules/aiqt/10-TRUST-human-oversight-and-autonomy-threshold.md); [`aiqt-rules/aiqt/10-TRUST-no-console-diff-dumps.md`](aiqt-rules/aiqt/10-TRUST-no-console-diff-dumps.md); [`aiqt-rules/aiqt/10-TRUST-orchestrator-mistakes-register.md`](aiqt-rules/aiqt/10-TRUST-orchestrator-mistakes-register.md); [`aiqt-rules/aiqt/10-TRUST-reconcile-record-against-reality.md`](aiqt-rules/aiqt/10-TRUST-reconcile-record-against-reality.md); [`aiqt-rules/aiqt/10-TRUST-records-first.md`](aiqt-rules/aiqt/10-TRUST-records-first.md); [`aiqt-rules/aiqt/10-TRUST-session-close-on-green.md`](aiqt-rules/aiqt/10-TRUST-session-close-on-green.md); [`aiqt-rules/aiqt/10-TRUST-session-resume-from-handoff.md`](aiqt-rules/aiqt/10-TRUST-session-resume-from-handoff.md); [`aiqt-rules/aiqt/10-TRUST-standing-constraints-persist.md`](aiqt-rules/aiqt/10-TRUST-standing-constraints-persist.md); [`aiqt-rules/aiqt/10-TRUST-trust-recovery-escalation.md`](aiqt-rules/aiqt/10-TRUST-trust-recovery-escalation.md); [`aiqt-rules/aiqt/10-TRUST-trust-recovery-ext.md`](aiqt-rules/aiqt/10-TRUST-trust-recovery-ext.md); [`aiqt-rules/aiqt/20-PROGR-decision-classification-before-enacting.md`](aiqt-rules/aiqt/20-PROGR-decision-classification-before-enacting.md); [`aiqt-rules/aiqt/20-PROGR-repeated-failure-triggers-premise-review.md`](aiqt-rules/aiqt/20-PROGR-repeated-failure-triggers-premise-review.md); [`aiqt-rules/aiqt/30-SPEED-background-work-during-ci-waits.md`](aiqt-rules/aiqt/30-SPEED-background-work-during-ci-waits.md); [`aiqt-rules/aiqt/40-COST-cost-tier.md`](aiqt-rules/aiqt/40-COST-cost-tier.md) - security: [`aiqt-rules/security/SECA-resource-bounds.md`](aiqt-rules/security/SECA-resource-bounds.md); [`aiqt-rules/security/SECA-verified-restore-path.md`](aiqt-rules/security/SECA-verified-restore-path.md); [`aiqt-rules/security/SECC-data-boundary.md`](aiqt-rules/security/SECC-data-boundary.md); [`aiqt-rules/security/SECC-egress-destinations.md`](aiqt-rules/security/SECC-egress-destinations.md); [`aiqt-rules/security/SECC-keep-secrets-out.md`](aiqt-rules/security/SECC-keep-secrets-out.md); [`aiqt-rules/security/SECC-least-privilege-retrieval.md`](aiqt-rules/security/SECC-least-privilege-retrieval.md); [`aiqt-rules/security/SECC-no-cross-context-bleed.md`](aiqt-rules/security/SECC-no-cross-context-bleed.md); [`aiqt-rules/security/SECC-no-hidden-context-disclosure.md`](aiqt-rules/security/SECC-no-hidden-context-disclosure.md); [`aiqt-rules/security/SECC-rotate-leaked-secret.md`](aiqt-rules/security/SECC-rotate-leaked-secret.md); [`aiqt-rules/security/SECI-authentication.md`](aiqt-rules/security/SECI-authentication.md); [`aiqt-rules/security/SECI-authorization.md`](aiqt-rules/security/SECI-authorization.md); [`aiqt-rules/security/SECI-config-is-executable-trust-gate.md`](aiqt-rules/security/SECI-config-is-executable-trust-gate.md); [`aiqt-rules/security/SECI-cryptography.md`](aiqt-rules/security/SECI-cryptography.md); [`aiqt-rules/security/SECI-dependency-provenance.md`](aiqt-rules/security/SECI-dependency-provenance.md); [`aiqt-rules/security/SECI-fail-closed.md`](aiqt-rules/security/SECI-fail-closed.md); [`aiqt-rules/security/SECI-federated-identity-flow.md`](aiqt-rules/security/SECI-federated-identity-flow.md); [`aiqt-rules/security/SECI-file-upload-handling.md`](aiqt-rules/security/SECI-file-upload-handling.md); [`aiqt-rules/security/SECI-guardrail-config-integrity.md`](aiqt-rules/security/SECI-guardrail-config-integrity.md); [`aiqt-rules/security/SECI-human-authorization.md`](aiqt-rules/security/SECI-human-authorization.md); [`aiqt-rules/security/SECI-input-validation.md`](aiqt-rules/security/SECI-input-validation.md); [`aiqt-rules/security/SECI-inter-agent-trust.md`](aiqt-rules/security/SECI-inter-agent-trust.md); [`aiqt-rules/security/SECI-key-management.md`](aiqt-rules/security/SECI-key-management.md); [`aiqt-rules/security/SECI-least-privilege-tools.md`](aiqt-rules/security/SECI-least-privilege-tools.md); [`aiqt-rules/security/SECI-log-redaction.md`](aiqt-rules/security/SECI-log-redaction.md); [`aiqt-rules/security/SECI-operator-deception.md`](aiqt-rules/security/SECI-operator-deception.md); [`aiqt-rules/security/SECI-output-encoding.md`](aiqt-rules/security/SECI-output-encoding.md); [`aiqt-rules/security/SECI-output-handling.md`](aiqt-rules/security/SECI-output-handling.md); [`aiqt-rules/security/SECI-pin-referenced-instructions.md`](aiqt-rules/security/SECI-pin-referenced-instructions.md); [`aiqt-rules/security/SECI-poisoning-resistance.md`](aiqt-rules/security/SECI-poisoning-resistance.md); [`aiqt-rules/security/SECI-prefer-removing-a-path.md`](aiqt-rules/security/SECI-prefer-removing-a-path.md); [`aiqt-rules/security/SECI-preview-has-no-side-effects.md`](aiqt-rules/security/SECI-preview-has-no-side-effects.md); [`aiqt-rules/security/SECI-prompt-trust-hierarchy.md`](aiqt-rules/security/SECI-prompt-trust-hierarchy.md); [`aiqt-rules/security/SECI-protect-audit-records.md`](aiqt-rules/security/SECI-protect-audit-records.md); [`aiqt-rules/security/SECI-reject-vulnerable-versions.md`](aiqt-rules/security/SECI-reject-vulnerable-versions.md); [`aiqt-rules/security/SECI-release-integrity.md`](aiqt-rules/security/SECI-release-integrity.md); [`aiqt-rules/security/SECI-safe-deserialization.md`](aiqt-rules/security/SECI-safe-deserialization.md); [`aiqt-rules/security/SECI-secure-configuration.md`](aiqt-rules/security/SECI-secure-configuration.md); [`aiqt-rules/security/SECI-security-logging.md`](aiqt-rules/security/SECI-security-logging.md); [`aiqt-rules/security/SECI-session-token-management.md`](aiqt-rules/security/SECI-session-token-management.md); [`aiqt-rules/security/SECI-ssrf-prevention.md`](aiqt-rules/security/SECI-ssrf-prevention.md); [`aiqt-rules/security/SECI-symlink-resolution.md`](aiqt-rules/security/SECI-symlink-resolution.md); [`aiqt-rules/security/SECI-threat-model-boundaries.md`](aiqt-rules/security/SECI-threat-model-boundaries.md); [`aiqt-rules/security/SECI-tool-argument-validation.md`](aiqt-rules/security/SECI-tool-argument-validation.md); [`aiqt-rules/security/SECI-untrusted-content.md`](aiqt-rules/security/SECI-untrusted-content.md); [`aiqt-rules/security/SECI-verify-dependency-exists.md`](aiqt-rules/security/SECI-verify-dependency-exists.md); [`aiqt-rules/security/SECP-data-minimization.md`](aiqt-rules/security/SECP-data-minimization.md); [`aiqt-rules/security/SECP-data-residency-retention.md`](aiqt-rules/security/SECP-data-residency-retention.md); [`aiqt-rules/security/SECP-purpose-limitation.md`](aiqt-rules/security/SECP-purpose-limitation.md); [`aiqt-rules/security/SECP-synthetic-fixture-data.md`](aiqt-rules/security/SECP-synthetic-fixture-data.md) The governance entries above are retained GRC procedures. Explicit GRC compatibility governs local policy conflicts.