North star: Every JBNX project meets the same required security controls, with evidence that each one was tested and deployed, not assumed. Hard gates (never bend): verify identity before privileged work; enforce data-boundary access; no public vulnerability detail or private records; billable limits reserved first; deployed result verified before closing a finding Everything else is a default. Try a better or unusual way when it serves the north star; record what you changed and why in the change log. Change log: bottom of this page (who, when, why).
This standard applies to all projects and shared services. It defines required controls; it does not certify that every system has already passed them.
Verify caller identity before authorizing privileged work. Bind human and machine identities to explicit roles, projects, operations, and environments. A project lease or an actor name is a coordination record, not authentication. Use expiring, revocable credentials and an authenticated recovery path.
Enforce membership, ownership, and role restrictions at the data boundary. Grant internal worker functions only to trusted workers. Review views and privileged functions as well as row-level policies. Keep production sessions and trusted origins narrow; isolate test and demo identities and data.
Validate outbound destinations and redirects, and enforce network, time, size, concurrency, and spending limits. Reserve billable resources before work. Derive attribution from verified context. Verify competitive game results on the server.
Patch dependencies, pin build inputs, preserve release evidence, and test restore procedures. Validate each change with a focused denial case (including a cross-project denial) and a legitimate-use case. Verify the deployed result before marking a finding closed.
For secret handling see the credentials-policy framework page. Maintain a private per-project finding register with owner, severity, affected environment, remediation, deployment reference, validation evidence, and residual risk. Public pages contain standards only, never detailed vulnerability reports or private records. Track states as planned, implemented, verified, or blocked. Example: "RLS on invoices: implemented (PR merged); verified only after a denial test and a live-site check pass." If a control truly does not apply, record "not applicable" with the reason rather than leaving it blank. Default: work available leases first and revisit occupied leases last. Do not treat untested areas as secure.
Every change to this framework: who, when, why. Source: agent_ops.catalog_changelog.
| When (UTC) | Who | Version | What | Why |
|---|---|---|---|---|
| 2026-11-11 10:35 | 1099:claude-chat-c1d3 | v3 | Delivery: denial test now names cross-project denial. | Align with hi.jbnx.io/core (test unauthorized and cross-project denial); cross-project leaks are the main data-boundary risk the north star targets. |
| 2026-11-08 16:17 | 1099:claude-chat-c1d3 | v2 | Portfolio security baseline | Owner-requested north-star review 2026-11-08: north star + hard gates header, top fixes, non-safety rules loosened to defaults (details in the page change log) |
| 2026-09-11 22:38 | 1099:openai-work-543d | v1 | Portfolio security baseline | not recorded (before change log started 2026-11-08) |