Skip to content
Agent OS
AOS-GOV-004 Normative foundation

Security Disclosure and Response

Security Disclosure and Response: scope, decisions, requirements, evidence, risks, and traceability for the Agent OS programme.

Edit on GitHub →

Security Disclosure and Response

This document defines how decisions, contributions, funding, security reports, partnerships, and public claims are governed.

Table of Contents

Purpose and Scope

Area: Governance.

This document defines how decisions, contributions, funding, security reports, partnerships, and public claims are governed.

This document owns the semantics implied by Security Disclosure and Response. It does not assert that every described subsystem already exists. It defines the target model, constraints, evidence needed to trust an implementation, and the boundary with adjacent documents.

Normative Position

  1. Model assets, actors, trust boundaries, capabilities, update keys, hardware roots, user data classes, agents, and external providers.
  2. Default-deny authority, explicit data minimization, compartmentalized parsers, and measured recovery are system properties.
  3. Hardware-bound secrets are non-exportable; migration re-enrolls rather than copies them.

Operating Model

The operating model is contract-first and evidence-driven. A component declares its authority, resources, lifecycle, error model, cancellation and timeout behavior, observability, version, and compatibility promise. Backends are replaceable only when the same conformance suite passes and no forbidden platform type leaks into portable layers.

Implementation proceeds through a reference model or mock, deterministic QEMU evidence where relevant, documentation-first physical hardware, and quality-hardware evidence. Pixel 9 adapters remain quarantined according to ADR-0004.

Requirements

  • R01. Model assets, actors, trust boundaries, capabilities, update keys, hardware roots, user data classes, agents, and external providers.
  • R02. Default-deny authority, explicit data minimization, compartmentalized parsers, and measured recovery are system properties.
  • R03. Hardware-bound secrets are non-exportable; migration re-enrolls rather than copies them.
  • R04. Specify normal, partial, denied, timeout, cancellation, restart, upgrade, and permanent-failure behavior.
  • R05. Expose structured diagnostics without leaking secrets or vendor-specific implementation details.
  • R06. Link material unknowns to a claim and, when testable, an experiment with an owner and gate.
  • R07. Update affected documentation and task data when evidence changes the model.

Failure and Degradation

Degradation must be explicit rather than accidental. The system reports capability absence, reduced quality, unavailable provider, stale data, or unsafe condition through typed states. It must not silently fall back to broader authority, unrestricted legacy execution, unverified firmware, lossy data migration, or irreversible agent action.

Recovery defines what state is retained, reconstructed, re-enrolled, compensated, or intentionally discarded. Unsupported hardware or providers are rejected at binding time where possible.

Evidence and Acceptance

  • Threat-model review and abuse-case tests.
  • SBOM, provenance, signing and reproducible-build evidence.
  • Security, privacy and agent red-team suites.
  • Evidence records target identity, hardware revision, firmware, source commit, toolchain, configuration, seed, timestamps, artifacts, expected result, actual result, and reviewer.
  • Acceptance requires the referenced tasks to meet their own criteria; prose completion is not implementation completion.

Implementation Obligations

Task Obligation Priority Gate/Milestone Verification
AOS-SEC-061 Establish secure software and model supply-chain process P1 M8 internal audit and simulated dependency/signing/secret/model provenance incidents
AOS-SEC-090 Operate vulnerability disclosure and incident response P0 Continuous quarterly tabletop plus seeded report from intake through patched release
AOS-COMM-080 Publish security contact, safe-harbor, and researcher workflow P0 M2 seed report from public page through triage and coordinated response

Risks and Open Questions

  • Agents increase the blast radius of confused authority.
  • Supply-chain compromise can bypass runtime isolation.
  • Debug and trace facilities can leak data or weaken secure boot.
  • Open-question rule: an unanswered high-impact question becomes a claim/experiment record and cannot be hidden in meeting notes.
  • Stop rule: work stops or changes track when legal rights, recovery, debug access, safety, or the required evidence path is unavailable.

Related Documents

Planning Reference Anchors

Reporting Vulnerabilities

AOS-SEC-090 — Operate vulnerability disclosure and incident response; AOS-SEC-090 — Operate vulnerability disclosure and incident response; AOS-COMM-080 — Publish security contact, safe-harbor, and researcher workflow; AOS-COMM-080 — Publish security contact, safe-harbor, and researcher workflow

Researcher Safe Harbor

AOS-COMM-080 — Publish security contact, safe-harbor, and researcher workflow; AOS-COMM-080 — Publish security contact, safe-harbor, and researcher workflow

Response Process

AOS-SEC-061 — Establish secure software and model supply-chain process; AOS-SEC-090 — Operate vulnerability disclosure and incident response; AOS-SEC-090 — Operate vulnerability disclosure and incident response