- Model output is always untrusted.
- A model proposal can never grant authority.
- Authorization must originate from authenticated host context.
- Approval must be bound to canonical tool arguments.
- Critical decisions must be deterministic.
- Semantic model judgments may deny or escalate, but never independently authorize.
- Execution authority must be scoped, expiring and single-use.
- Unknown fields and unknown enum values fail closed.
- Missing provenance is untrusted provenance.
- Missing policy results in denial.
- Audit logs must not contain secrets or raw prompts by default.
- Implement one approved phase at a time.
- Do not broaden scope without documenting the reason.
- Every security invariant requires negative tests.
- Never weaken a test solely to make it pass.
- Never silently fall back from secure storage or cryptographic verification.
- Public APIs require documentation and usage examples.
- Run the complete test suite before declaring a phase complete.