secure-architecture

Goal

Enforce robust, defense-in-depth architectural patterns including Zero Trust boundaries, secure access service edge (SASE), network segmentation, and strict IAM.

Steps

1. Perimeter Audit: Assume breach. Establish micro-perimeters around critical logical domains.
2. Access Policy: Design the Authorization logic (e.g., using OPA or AWS IAM) ensuring least privilege access across all services.
3. Data Protection: Mandate explicit data transit TLS boundaries and rest encryption.
4. Verification: Verify that the C4 diagrams explicitly mark trusted vs untrusted zones and the security boundary implementations.

Security & Guardrails

1. Skill Security

• Config Drift Ban: The agent must not manually execute cloud IAM changes without outputting them as declarative Infrastructure as Code (e.g., Terraform/CloudFormation) for review.
• Root Veto: Explicitly forbid creating or assigning "Admin", "*", or equivalent root-level global actions to any service role inside the generated documentation.

2. System Integration Security

• MFA Enforcement: Any external/remote access vectors defined in the architecture must explicitly mandate Multi-Factor Authentication.
• Fail Closed Mechanism: All network authorization services, if unavailable, must fail-closed (denying access), never fail-open.