Source: https://guthlabs.ai/docs/jobs/stan-security-engineering/field-guides/ job / candidate # Security engineering โ€” field guides The distinct field guides record for Security engineering. This page is proposal-only. Status: **proposed**Lifecycle: **candidate** ## Record status **Record ID**: job:stan:security-engineering **Parent lifecycle**: candidate **Page lane**: docs_urls **Lane lifecycle**: proposed **Owner**: Stan **Owner role**: Chief Security and Engineering Officer **Owner status**: VERIFIED **Qualification result**: NOT RUN ยท held for evidence and human review **Working browser surface:** [Agent jobs โ€” builder overview]() โ€” Inspect the package and stage a local project. This route is local-only; provider, credential, database, customer, publication, deployment, and production effects remain held. ## Related field-guide records - /app/notebook/field-guides/ Source-proposed guide paths are references, not proof that those paths resolve. ## Operating sequence - Open the source-bound job record and create a current-work packet. - Normalize the request into objective, scope, exclusions, urgency, and deadline. - Collect only supplied or locally available evidence and preserve source labels, locators, revisions, and hashes when available. - Classify the task as assessment, architecture review, incident coordination, continuity work, or gated remediation proposal. - Identify affected systems, records, dependencies, failure states, and accessibility needs. - Record risks, assumptions, unknowns, and confidence separately; never treat confidence as permission. - Draft a bounded plan with owners, dependencies, explicit deadlines, verification methods, and rollback or containment notes. - Check each proposed action against the principal gates: destructive remediation, money or purchasing, credential changes, public deployment, and legal filing. - Create or link approval records for every gated effect and mark unapproved effects Held. - Use Assurance preflight and Source-bound recall to review evidence, scope, and authority before handoff. - Prepare communication drafts and incident updates without sending external messages or changing provider state. - Write a receipt ledger entry and agent log stating what was reviewed, proposed, blocked, approved locally, or not performed. - Create continuity and handoff records, including open loops, next owner, and next review date. - Run deterministic acceptance tests and leave the package in proposal-only state. ## Handoff boundary - Confusing Stan's job ownership with permission to execute gated effects. - Manufacturing Antonio's authority or attributing approval without a record. - Treating confidence, urgency, or incident severity as permission. - Executing destructive remediation, credential changes, purchasing, public deployment, or legal filing without human approval. - Assuming Supabase, Cloudflare, terminal, database, provider, or production connectivity from a named guide or route. - Overstating incident facts when evidence is incomplete, stale, or unverified. - Losing provenance, source hashes, revisions, attachments, or receipt continuity. - Sending an external message or publishing a status update from a draft surface. - Turning deadline fields into hidden automation or provider calendar writes. - Exposing sensitive security evidence through public docs, search, or customer-facing surfaces. - Creating doorway documentation routes with duplicated or non-useful content. - Making inaccessible forms or relying on color alone for Held, Needs review, or Approved states. ## Sources and evidence These pointers bind the page to evidence. They do not grant authority or collapse verification into deployment. - `agents/index.html#stan` - `source_record:job:stan:security-engineering` - `Observed native contract: project_and_field_guide_collections` - `Observed native contract: deadlines` - `Observed native contract: records` - `Observed native contract: pointguard` - `App route: /app/pointguard/` - `App route: /app/notebook/field-guides/` - `App route: /app/notebook/agent-logs/` - `App route: /app/notebook/approvals/` - `App route: /app/notebook/projects/` - `App route: /app/notebook/to-dos/` - `App route: /app/notebook/messages/` - `App route: /app/notebook/files/` - `App route: /app/notebook/search/` - `App route: /app/business/messages/` - `App route: /app/business/vault/` - `source record job:stan:security-engineering` - `Observed native contract: web_boundary` - `App route /app/pointguard/` - `App route /app/notebook/approvals/` - `App route /app/notebook/agent-logs/` - `App route /app/notebook/projects/` - `App route /app/notebook/field-guides/`