Least authority
Components should receive only the access required for their declared role.
SECURITY MODEL
Bounded authority is a security control.
Infrastructure Product Works separates proposal, deterministic validation, human decision and infrastructure execution. No product component should acquire broader operational authority merely because it participates in the workflow.
Evidence integrity
Validation evidence is intended to remain bound to the source and decision context it represents.
Customer controls
Branch protection, approval, credentials and production controls remain customer responsibilities and boundaries.
No implicit deployment
A PASS result is not an instruction to apply or provision infrastructure.
Deterministic gates
Policy-sensitive validation favors bounded, testable rules over unconstrained model judgment.
Responsible reporting
Do not disclose suspected vulnerabilities through public issues when doing so would expose exploit details or sensitive information.