| name | security-or-authz-change |
| description | Use when changing authz, RBAC, RLS, audit ledger, OCR provenance, secret handling, SCIM, SSO, CSP, supply-chain dependencies, or any RC3 security surface listed in docs/governance/03-change-risk-matrix.md. Enforces maker-checker discipline, negative tests, and source citations. Aligned with docs/workflows/security-or-authz-change.md. |
security-or-authz-change
When to use
Activated automatically by chief-orchestrator whenever the changed
paths intersect with the RC3 surfaces in
docs/governance/03-change-risk-matrix.md. Mandatory
maker-checker discipline.
Method
- Research dossier first. Run
research-dossier-build and
cite the relevant standard (NIST SP, OWASP rule, CWE, ISO 27001
control). Save under docs/research/.
- Threat model delta. Either update the existing threat model
for this surface (under
docs/security/ or docs/iso27001/)
or note explicitly why no update is needed.
- Negative tests planned upfront. For each role
(
carrier_admin, safety_manager, dispatcher, driver,
solo_driver): which rejection path is tested by this PR?
- Implement. Follow
.claude/rules/security-authz-and-trust-boundaries.md.
- Audit ledger / OCR provenance integrity preserved.
Append-only, monotonic sequence, full provenance fields on
regulator-facing artifacts.
- Verify.
npm run lint, npm run typechecknpm test — count stable or explainednpm run buildnpm run test:e2e (covered path)npm run governance:checknpm run agentos:check- CI: dependency audit
--audit-level=high, gitleaks working
tree, semgrep (review findings), governance index.
- Independent review. Hand off to
assurance-security-compliance-office. Builder cannot self-review.
- Third verifier.
research-evidence-bureau confirms citations.
- PR. Draft only. Use
pr-readiness-and-owner-handoff to
assemble the final body.
Output
- A research dossier under
docs/research/.
- A threat-model update (or a justification for none).
- Code change with negative-test coverage.
- Verification command log.
- Independent reviewer note and verifier note.
- Draft PR.
Anti-patterns
- Loosening an existing control "for now".
- Adding a "re-enable later" deferral comment next to an authz check.
- A new SCIM / SSO path with no malformed-payload test.
- A migration to an RC3 surface with no rollback plan.
