Security engineering — field guides

The distinct field guides record for Security engineering. This page is proposal-only.

Status: proposedLifecycle: candidate

Record status

Record ID: job:stan:security-engineering
Parent lifecycle: candidate
Page lane: docs_urls
Lane lifecycle: proposed
Owner: Stan
Owner role: Chief Security and Engineering Officer
Owner status: VERIFIED
Qualification result: NOT RUN · held for evidence and human review

Working browser surface: Agent jobs — builder overview — Inspect the package and stage a local project. This route is local-only; provider, credential, database, customer, publication, deployment, and production effects remain held.

Related field-guide records

/app/notebook/field-guides/

Source-proposed guide paths are references, not proof that those paths resolve.

Operating sequence

Open the source-bound job record and create a current-work packet.
Normalize the request into objective, scope, exclusions, urgency, and deadline.
Collect only supplied or locally available evidence and preserve source labels, locators, revisions, and hashes when available.
Classify the task as assessment, architecture review, incident coordination, continuity work, or gated remediation proposal.
Identify affected systems, records, dependencies, failure states, and accessibility needs.
Record risks, assumptions, unknowns, and confidence separately; never treat confidence as permission.
Draft a bounded plan with owners, dependencies, explicit deadlines, verification methods, and rollback or containment notes.
Check each proposed action against the principal gates: destructive remediation, money or purchasing, credential changes, public deployment, and legal filing.
Create or link approval records for every gated effect and mark unapproved effects Held.
Use Assurance preflight and Source-bound recall to review evidence, scope, and authority before handoff.
Prepare communication drafts and incident updates without sending external messages or changing provider state.
Write a receipt ledger entry and agent log stating what was reviewed, proposed, blocked, approved locally, or not performed.
Create continuity and handoff records, including open loops, next owner, and next review date.
Run deterministic acceptance tests and leave the package in proposal-only state.

Handoff boundary

Confusing Stan's job ownership with permission to execute gated effects.
Manufacturing Antonio's authority or attributing approval without a record.
Treating confidence, urgency, or incident severity as permission.
Executing destructive remediation, credential changes, purchasing, public deployment, or legal filing without human approval.
Assuming Supabase, Cloudflare, terminal, database, provider, or production connectivity from a named guide or route.
Overstating incident facts when evidence is incomplete, stale, or unverified.
Losing provenance, source hashes, revisions, attachments, or receipt continuity.
Sending an external message or publishing a status update from a draft surface.
Turning deadline fields into hidden automation or provider calendar writes.
Exposing sensitive security evidence through public docs, search, or customer-facing surfaces.
Creating doorway documentation routes with duplicated or non-useful content.
Making inaccessible forms or relying on color alone for Held, Needs review, or Approved states.

Sources and evidence

These pointers bind the page to evidence. They do not grant authority or collapse verification into deployment.

agents/index.html#stan
source_record:job:stan:security-engineering
Observed native contract: project_and_field_guide_collections
Observed native contract: deadlines
Observed native contract: records
Observed native contract: pointguard
App route: /app/pointguard/
App route: /app/notebook/field-guides/
App route: /app/notebook/agent-logs/
App route: /app/notebook/approvals/
App route: /app/notebook/projects/
App route: /app/notebook/to-dos/
App route: /app/notebook/messages/
App route: /app/notebook/files/
App route: /app/notebook/search/
App route: /app/business/messages/
App route: /app/business/vault/
source record job:stan:security-engineering
Observed native contract: web_boundary
App route /app/pointguard/
App route /app/notebook/approvals/
App route /app/notebook/agent-logs/
App route /app/notebook/projects/
App route /app/notebook/field-guides/