atelier/domains/security/first-principles.md

# Security — First Principles

**Version:** 1.0.0
**Status:** Foundational
**Audience:** AI agents and humans handling authentication, data,
trust boundaries, or any security-relevant code.

## 1. Manifesto

Security is not a feature. It is a property of correct code. The
highest quality code is code that does what it is supposed to do —
and nothing else, no matter who asks.

An AI agent using this framework does not "add security". It writes
secure code by default. There is no version of correct code that is
insecure.

## 2. The Principles

### P1. Zero Trust
No request, user, system, or input is trusted by default. Trust is
earned at every boundary, every time.

### P2. Least Privilege
Every actor — user, service, process — gets the minimum access
required to do its job, for the minimum time required.

### P3. Defense in Depth
Security is layered. No single control is load-bearing. The failure
of one control does not compromise the system.

### P4. Input Validation
All input is untrusted until proven otherwise. Validation happens at
the boundary, against a schema, with explicit failure modes.

### P5. Output Safety
All output is encoded, escaped, or filtered for its destination
context. The system never trusts its callers, including itself.

### P6. Cryptographic Correctness
Crypto is hard. Use vetted, maintained libraries. Never roll your
own. Never invent your own primitives. Never bypass a primitive to
"make it work".

### P7. Auditability
Security-relevant events — auth attempts, authz decisions, data
access, configuration changes — are logged with sufficient context
to investigate.

### P8. Fail Securely
When security fails, it fails closed. The default state is denied,
disabled, or safe. Errors never grant access by accident.

### P9. Secret Hygiene
Secrets are not in code, configs, logs, error messages, URLs, or
screenshots. Secrets are loaded from a secrets manager and treated
as transient.

### P10. Surface Minimization
The smaller the attack surface, the smaller the risk. Dependencies
are minimized. Endpoints are minimized. Features are minimized. Code
that does not exist cannot be exploited.

## 3. Conflict Resolution

1. Zero Trust — never sacrificed.
2. Least Privilege — never sacrificed.
3. Defense in Depth — never sacrificed.
4. Input Validation — never sacrificed.
5. Output Safety — never sacrificed.
6. Cryptographic Correctness — never sacrificed.
7. Fail Securely — never sacrificed.
8. Auditability — sacrificed only when logging itself is the threat.
9. Secret Hygiene — never sacrificed.
10. Surface Minimization — sacrificed only when a feature is required.

Eight of ten principles are non-tradeable. Security does not
trade-off. It is either present or it is not.

## 4. What Violates These Principles

| Violation                          | Principle Breached    |
|------------------------------------|----------------------|
| `SELECT *` from user input         | P4 Input Validation  |
| `eval()` of any string             | P4, P5               |
| Hardcoded API key in source        | P9 Secret Hygiene    |
| Catch-all `catch (e) {}`           | P7 Auditability, P8 Fail Securely |
| `md5` or `sha1` for security       | P6 Crypto Correctness |
| Open CORS to `*` in production     | P1 Zero Trust, P10   |
| Detailed error to end user         | P7 Auditability, P5  |
| `chmod 777`                        | P2 Least Privilege   |
| Long-lived session token           | P1, P2               |
| Logging the request body           | P9 Secret Hygiene    |

These are never acceptable. They are not "to be reviewed later".
They are rejected on sight.

## 5. Relationship to Core

Subordinate to `core/first-principles.md`. Note: security principles
overlap heavily with core Correctness (C1) and Observability (C7).
See `matrix/principles-matrix.md`.