Diagnose and design the fix for the "change didn't take effect" access-bug class — a removed user still sees the data, a revoked role still works, logout doesn't end the session, a plan change still shows the old tier, a deleted item stays visible: inventory every place the old authority survives (server session records, JWT/token claims until expiry, client-side stores and data caches, server/CDN caches, live realtime subscriptions, database session context, search indexes, signed URLs), locate which holds the stale copy, design the invalidation or forced refresh per surface against a stated revocation-latency bound (deny direction first: revoked access must actually revoke), and verify with before/after tests that access changed. Composes caching-strategy-designer, realtime-subscription-architect, plan-entitlement-architect, share-link-access-architect, rls-policy-auditor. Do NOT use to design a cache, author the permission matrix, or when access never worked — this owns changes that failed to propagate.
Decide cloud platform, abstraction rung, and deployment posture cloud-neutrally — gather requirements FIRST (compliance/residency, latency/regions, availability, cost, team maturity, existing estate), shape the provider-neutral logical architecture, THEN pick the highest abstraction rung the workload tolerates (IaaS/VPS → container-PaaS → managed-Jamstack/SSR → Postgres-BaaS → edge/serverless → hyperscaler), a provider within it (modern managed platforms e.g. Vercel/Render/Supabase/Cloudflare, or a hyperscaler AWS/Azure/GCP), and per-capability managed-vs-self-hosted posture — with tradeoffs, exit costs, and an ADR handoff. Ties to isolation, cost, and ops maturity, never fashion. Use when asked which cloud, provider, or platform tier to use, whether to migrate, managed-vs-self-hosted, or single-vs-multi-cloud. Do NOT use to MAP a decided provider to services (aws-/azure-saas-architect), system structure (architecture-designer), tenancy (saas-platform-architect), or IaC review (iac-reviewer).
Design a SAFE dynamic-testing (DAST) harness against a RUNNING application — the safety harness is the deliverable, not an attack method. Mandates EXPLICIT WRITTEN AUTHORIZATION before any run (scope, target, window, blast radius recorded — composes human-approval-boundary); staging/non-production targets only unless prod is explicitly authorized; rate/impact limits so it never DoS-es the target; no destructive probes without separate sign-off; data-handling; and the run/result contract. Fail-closed: no written authorization → no run. It DESIGNS the harness; it is NOT a penetration-testing playbook and does not enumerate exploits (out of scope). Use when planning authorized dynamic testing of a running app or building the safety harness around it. Do NOT use to enumerate exploits (out of scope), define WHAT to test (threat-modeler), test tenant isolation (multi-tenant-security-tester), or scan static code (security-scan-orchestrator).
Design HOW a SAST suite is RUN over a repository — category-level analyzer selection (not a named vendor), ruleset/config management, baseline + diff-scanning (gate NEW-since-baseline on PRs vs full scans), incremental-vs-full strategy, a GOVERNED false-positive suppression list (never silent inline muting), and CI integration. Designs the RUNNING of SAST and feeds the whole-repo aggregator (security-scan-orchestrator, in-batch); the INTERPRETATION of findings (true/false-positive, ranking, the suppression VERDICT) is static-analysis-reviewer's (yield). Fail-closed: a scan that errors, times out, or skips a language is a REPORTED GAP, never a silent pass. Use when standing up or tuning SAST, designing baseline/diff scanning, or governing FP suppression. Do NOT use to triage findings (static-analysis-reviewer), aggregate a whole-repo scan (security-scan-orchestrator), or scan dependencies (supply-chain-security-reviewer).
Orchestrate a whole-repo security scan and aggregate it into ONE prioritized report — coordinate the static suite (SAST + dependency/SCA + secret + IaC/config scanning), normalize every scanner's output into one finding schema, and route it. It RUNS and AGGREGATES; it does NOT triage findings (finding TRIAGE is static-analysis-reviewer's — yield) and NEVER fixes, opens PRs, or changes settings — every action is handed to a human. Tool-agnostic (scanner CATEGORIES, not one vendor's CLI). Fail-closed: a scanner that errors or cannot run is a REPORTED GAP, never a silent clean pass. Use when asked to security-scan a whole repo, run the scan suite, or aggregate multi-tool findings. Do NOT use to triage findings (static-analysis-reviewer), judge dependency risk (supply-chain-security-reviewer), design the SAST run (sast-orchestration-designer), or test a running app (dast-safety-harness-designer).
Design the governed operating environment an AI agent runs inside — the harness: ONE server-side mediation point every model/tool call crosses; identity from credentials (never from model-supplied payload), propagated; a deny-by-default pre-flight ladder (authenticate → authorize → entitlement → budget → input policy) BEFORE the model runs, each rung fail-closed; a CLOSED tool/provider registry (unknown capability fails, never improvised); instructions as server-side versioned artifacts no untrusted party can override; a fail-closed audit write — what cannot be recorded does not execute. The AI-specific harness atop command-gateway-architect's mediated path, enforcing agent-authorization-matrix's policy. Use when wiring an agent into a runtime or when model calls run ungoverned. DESIGNS the harness; its attack review belongs to agent-tool-safety-guard, agent-containment-reviewer, prompt-injection-defender. Do NOT use for loop bounds/stops (agentic-loop-designer) or context content (model-context-designer).
Design an agentic loop's shape and bounds — single-shot vs agentic as an EXPLICIT up-front decision (never default to a loop); clamped iteration ceilings; TYPED retryability (a policy rejection is TERMINAL, never retried; a transient failure is retried once on IDENTICAL input (reproducibility key) to classify flake vs deterministic); honest terminal states (an empty result is a legitimate stop, never forced into fabricated output); plan-act-observe-reflect with a defined stop. A loop needs an honest way to stop, including the honest empty set. Consumes iteration/cost caps from ai-cost-guardrail-designer (budget is an input; this owns loop SEMANTICS/stopping); designs the structure agent-failure-recovery plugs into; the loop runs INSIDE agent-harness-architect's harness. Use when deciding whether a task needs a loop, designing retry/stop behavior, or when an agent loops unbounded or fabricates on empty. DESIGNS the loop; manipulation attack review belongs to agent-goal-hijack-defender and ai-threat-modeler.
Design what enters and leaves a model's context window — a curated diet, not open access: context assembled SERVER-SIDE under hard token/size caps; every input passes a CLOSED schema; secrets/PII/raw payloads minimized or carried on a transient never-persisted channel with the persisted-vs-transient split explicit; what the model saw RECONSTRUCTIBLE afterward; exclusions designed and documented, never accidental. The context window is a supply chain — an unverified input is an unverified output. Distinct from agent-startup-context-gate (session-START loading; this is runtime per-call assembly), ai-cost-guardrail-designer (prices the spend; this decides the CONTENT), and rag-security-architect (who may retrieve; this curates what retrieval feeds the window). Use when designing prompt/context assembly, deciding what an agent may see, or when context is stuffed ad hoc. DESIGNS the curated context; the poisoning attack review belongs to memory-context-poisoning-reviewer.