atelier/domains/security/first-principles.md

Security — First Principles

Version: 1.0.0 Status: Foundational Audience: AI agents and humans handling authentication, data, trust boundaries, or any security-relevant code.

1. Manifesto

Security is not a feature. It is a property of correct code. The highest quality code is code that does what it is supposed to do — and nothing else, no matter who asks.

An AI agent using this framework does not "add security". It writes secure code by default. There is no version of correct code that is insecure.

2. The Principles

P1. Zero Trust

No request, user, system, or input is trusted by default. Trust is earned at every boundary, every time.

P2. Least Privilege

Every actor — user, service, process — gets the minimum access required to do its job, for the minimum time required.

P3. Defense in Depth

Security is layered. No single control is load-bearing. The failure of one control does not compromise the system.

P4. Input Validation

All input is untrusted until proven otherwise. Validation happens at the boundary, against a schema, with explicit failure modes.

P5. Output Safety

All output is encoded, escaped, or filtered for its destination context. The system never trusts its callers, including itself.

P6. Cryptographic Correctness

Crypto is hard. Use vetted, maintained libraries. Never roll your own. Never invent your own primitives. Never bypass a primitive to "make it work".

P7. Auditability

Security-relevant events — auth attempts, authz decisions, data access, configuration changes — are logged with sufficient context to investigate.

P8. Fail Securely

When security fails, it fails closed. The default state is denied, disabled, or safe. Errors never grant access by accident.

P9. Secret Hygiene

Secrets are not in code, configs, logs, error messages, URLs, or screenshots. Secrets are loaded from a secrets manager and treated as transient.

P10. Surface Minimization

The smaller the attack surface, the smaller the risk. Dependencies are minimized. Endpoints are minimized. Features are minimized. Code that does not exist cannot be exploited.

3. Conflict Resolution

1. Zero Trust — never sacrificed.
2. Least Privilege — never sacrificed.
3. Defense in Depth — never sacrificed.
4. Input Validation — never sacrificed.
5. Output Safety — never sacrificed.
6. Cryptographic Correctness — never sacrificed.
7. Fail Securely — never sacrificed.
8. Auditability — sacrificed only when logging itself is the threat.
9. Secret Hygiene — never sacrificed.
10. Surface Minimization — sacrificed only when a feature is required.

Eight of ten principles are non-tradeable. Security does not trade-off. It is either present or it is not.

4. What Violates These Principles

Violation	Principle Breached
SELECT * from user input	P4 Input Validation
eval() of any string	P4, P5
Hardcoded API key in source	P9 Secret Hygiene
Catch-all catch (e) {}	P7 Auditability, P8 Fail Securely
md5 or sha1 for security	P6 Crypto Correctness
Open CORS to * in production	P1 Zero Trust, P10
Detailed error to end user	P7 Auditability, P5
chmod 777	P2 Least Privilege
Long-lived session token	P1, P2
Logging the request body	P9 Secret Hygiene

These are never acceptable. They are not "to be reviewed later". They are rejected on sight.

5. Relationship to Core

Subordinate to core/first-principles.md. Note: security principles overlap heavily with core Correctness (C1) and Observability (C7). See matrix/principles-matrix.md.