Security you can re-verify, not just read about

Thirty non-negotiable invariants, encoded as tests and database constraints, exercised against clean databases on every verification run.

The thirty invariants

These are requirements the test suite must encode — not aspirations. Each is enforced in application code and, wherever possible, again in PostgreSQL constraints and triggers.

ID	Invariant
`INV-01`	A disabled, revoked, expired, or quarantined principal cannot receive new authorization.
`INV-02`	A denied action cannot execute through any TrustRail gateway.
`INV-03`	Any protected-field mutation after decision or approval invalidates authorization.
`INV-04`	One tenant cannot read, reference, mutate, approve, or execute another tenant's resources.
`INV-05`	Every gateway execution attempt references one valid decision and subject digest.
`INV-06`	Every privileged state transition commits its audit event in the same transaction.
`INV-07`	Published policy and schema versions are immutable and reconstructable.
`INV-08`	Production provider secrets never reach browsers, agents, logs, traces, or analytics.
`INV-09`	An ML or LLM result cannot weaken a deterministic denial or mandatory approval.
`INV-10`	A decision token cannot authorize more than one logical execution.
`INV-11`	Approval votes are bound to the exact subject digest and approval rule version.
`INV-12`	A kill switch or revocation blocks sensitive execution within the stated propagation SLO.
`INV-13`	Child authority is a subset of every ancestor grant and current policy.
`INV-14`	A revoked ancestor makes all descendant authority ineffective.
`INV-15`	Binding commitments cannot be inferred solely from natural-language messages.
`INV-16`	A provider timeout never becomes an assumed failure or assumed success.
`INV-17`	Audit-chain forks are rejected by database concurrency controls.
`INV-18`	No security decision relies on client-controlled tenant, role, risk, time, or digest values.
`INV-19`	Agent-workload egress is denied unless an effective allowlist entry authorizes it.
`INV-20`	Requested host, pinned DNS result, and observed TLS SNI must agree.
`INV-21`	Broker or policy-cache loss fails closed and creates no bypass route.
`INV-22`	Contained agents cannot distinguish containment from an ordinary denial response.
`INV-23`	Automated containment may only restrict authority; widening requires a human.
`INV-24`	Containment tiers are strictly ordered and cannot be skipped toward more authority.
`INV-25`	The forensic plane has no provider credential or control-plane write path.
`INV-26`	No forensic analysis proceeds before the evidence chain verifies.
`INV-27`	Every privileged transition appends evidence in the same transaction.
`INV-28`	No action is called executable without a registered adapter and reconciliation test.
`INV-29`	Untrusted influence may tighten authorization and can never widen it.
`INV-30`	Protected tools execute only against pinned definitions and canonical mappings.

Defense in depth, concretely

Four database roles

Application, gateway, worker, and audited break-glass repair — all NOLOGIN, non-superuser, and unable to bypass row-level security. The worker's only privilege is executing narrow claim functions.

Canonicalization as the root of trust

A from-scratch RFC 8785 implementation with golden vectors, duplicate-key detection (including escape-equivalent duplicates), and strict Unicode handling. Every signature and approval binds to its digests.

SSRF-safe provider transport

Exact-origin pinning, HTTPS only, private/loopback/link-local/metadata ranges rejected after DNS resolution, and the resolved address pinned to defeat DNS rebinding between check and connect.

Hardened execution tokens

Ed25519, canonical JSON encoding, closed claim set (unknown claims rejected), 300-second lifetime cap, base64url canonicity checks, revocation-first key lookup, and atomic one-use consumption.

Everything bounded

Body limits, string caps, policy step budgets, response size ceilings, statement timeouts, bounded retries, capped archives. Unbounded input is treated as the primary denial-of-service vector.

Fail closed, visibly

Missing policy denies. Unknown risk facts count as maximum risk. Stale JWKS is an outage, not a bypass. Readiness endpoints report exactly which dependency failed, with reason codes instead of fabricated success.

Review posture: every milestone ships with a threat model, an executable clean-database rehearsal, and a written review record. Internal deep reviews are complete and documented in-repo; independent external review gates are tracked openly and are never fabricated.