Source: https://guthlabs.ai/docs/jobs/stan-security-engineering/tools/ job / candidate # Security engineering — tools The distinct tools record for Security engineering. This page is proposal-only. Status: **proposed**Lifecycle: **candidate** ## Record status **Record ID**: job:stan:security-engineering **Parent lifecycle**: candidate **Page lane**: package **Lane lifecycle**: proposed **Owner**: Stan **Owner role**: Chief Security and Engineering Officer **Owner status**: VERIFIED **Qualification result**: NOT RUN · held for evidence and human review **Working browser surface:** [Agent jobs — builder overview]() — Inspect the package and stage a local project. This route is local-only; provider, credential, database, customer, publication, deployment, and production effects remain held. ## Authoritative package lane tools and interfaces ### Canonical tools-page assignments - **Assurance preflight** (skill · required) — Check evidence, scope, risk, authority boundaries, and held gates before any recommendation is handed off. - **Terminal courier** (interface · required) — Stage bounded local engineering work and inspect command or artifact receipts without implying external execution. - **Receipt ledger** (record · required) — Preserve durable evidence of proposed, reviewed, blocked, or completed-local work. - **Source-bound recall** (skill · required) — Keep findings tied to supplied source records, locators, revisions, and provenance. - **Security field guides** (guide · required) — Provide reusable security procedures and prerequisites for bounded review. - **Supabase field guide** (guide · optional) — Use only when the supplied task concerns Supabase; it does not establish provider access or database authority. - **Cloudflare operations** (guide · optional) — Use only when the supplied task concerns Cloudflare; it does not establish provider access or deployment authority. - **Current-work packets** (guide · required) — Structure active work, deadlines, evidence, blockers, and handoff state. - **PointGuard** (interface · required) — Carry bounded context across specialist surfaces while leaving canonical records with their owning apps. Only the page's admitted lane is rendered as an assignment. Other lane inventories remain source records but are not merged here. Tool kind and required/optional status are preserved. ## Authoritative lane instrument assignments ### Canonical tools-page assignments No verified instrument is assigned to this tools lane. An instrument listed only for another lane does not become a tools-page assignment. ## Use boundary - Confusing Stan's job ownership with permission to execute gated effects. - Manufacturing Antonio's authority or attributing approval without a record. - Treating confidence, urgency, or incident severity as permission. - Executing destructive remediation, credential changes, purchasing, public deployment, or legal filing without human approval. - Assuming Supabase, Cloudflare, terminal, database, provider, or production connectivity from a named guide or route. - Overstating incident facts when evidence is incomplete, stale, or unverified. - Losing provenance, source hashes, revisions, attachments, or receipt continuity. - Sending an external message or publishing a status update from a draft surface. - Turning deadline fields into hidden automation or provider calendar writes. - Exposing sensitive security evidence through public docs, search, or customer-facing surfaces. - Creating doorway documentation routes with duplicated or non-useful content. - Making inaccessible forms or relying on color alone for Held, Needs review, or Approved states. ## Sources and evidence These pointers bind the page to evidence. They do not grant authority or collapse verification into deployment. - `agents/index.html#stan` - `source_record:job:stan:security-engineering` - `Observed native contract: project_and_field_guide_collections` - `Observed native contract: deadlines` - `Observed native contract: records` - `Observed native contract: pointguard` - `App route: /app/pointguard/` - `App route: /app/notebook/field-guides/` - `App route: /app/notebook/agent-logs/` - `App route: /app/notebook/approvals/` - `App route: /app/notebook/projects/` - `App route: /app/notebook/to-dos/` - `App route: /app/notebook/messages/` - `App route: /app/notebook/files/` - `App route: /app/notebook/search/` - `App route: /app/business/messages/` - `App route: /app/business/vault/`