Security Architecture

---
name: security-architecture
description: |
  System-level security architecture: threat modeling, secure-by-design,
  defense-in-depth, zero-trust, trust boundaries, TEE/confidential computing,
  and secure boot / chain of trust. Architect-level — designing the security of
  a system, not app-level OWASP bug fixing.

  USE WHEN: designing a system's security architecture, "threat model",
  "zero-trust", "defense in depth", "trust boundary", "TEE", "enclave",
  "confidential computing", "secure boot", "attack surface", security design review.

  DO NOT USE FOR: fixing app vulnerabilities / OWASP code issues (use the
  security agent/skills); auth library wiring (use authentication skills).
allowed-tools: Read, Grep, Glob
---
# Security Architecture

Design security into the system shape — not bolt it on after.

## Start with a threat model
1. **What are we protecting?** (assets, data classifications)
2. **From whom?** (threat actors, capabilities)
3. **Trust boundaries** — draw them: where does data/control cross between
   differently-trusted components? Each crossing is where to authenticate,
   authorize, validate, and encrypt.
4. **Enumerate threats** (STRIDE: Spoofing, Tampering, Repudiation, Info
   disclosure, DoS, Elevation) per boundary; rank by risk; design mitigations.

## Architectural principles
- **Defense in depth**: independent layers so one failure isn't catastrophic.
- **Least privilege** + **least authority**: minimal scope per component;
  capability-based over ambient authority where possible.
- **Minimize attack surface & TCB**: fewer entry points, smaller trusted base
  (favors microkernel/microVM isolation — see `os-kernel-architecture`,
  `virtualization`).
- **Fail securely**: deny by default; errors don't open access.
- **Secure by design/default**: safe defaults, secrets never in code, encryption
  in transit + at rest.

## Zero-trust
Drop implicit network trust. Authenticate + authorize **every** request
(identity, device posture, policy) regardless of network location;
micro-segment; assume breach. Replaces the "hard perimeter, soft interior" model.

## Hardware / platform security
- **TEE / enclaves** (SGX, TrustZone, SEV-SNP, TDX): run/seal sensitive
  computation isolated from the OS/host — for untrusted-host or
  confidential-computing scenarios.
- **Secure boot / chain of trust**: each stage verifies the next from a hardware
  root of trust; measured boot + attestation for remote trust.
- **Key management**: HSM/KMS, rotation, envelope encryption; never hand-roll crypto.

## When to invoke this
- New system/platform design, multi-tenant or untrusted-input systems,
  regulated data, anything internet-facing or handling secrets/PII. Produce a
  threat model + trust-boundary diagram + mitigations as part of the ADR.