# SAFETY.md

> Document threats, assets, identities, authority boundaries, least-privilege controls, approval policies, data protections, abuse cases, and incident response for agent behavior and tool use.

**Decision rule:** Grant the minimum authority required for the current outcome and re-check authorization at the action boundary. Add human approval when consequences exceed delegated authority.

## How to use this template

- Replace every angle-bracket placeholder with project-specific evidence.
- Remove sections that do not apply instead of leaving ambiguous boilerplate.
- Link decisions to their specifications, tasks, tests, traces, and owners.
- Re-review this file when the workflow, authority boundary, or primary source changes.

## Threat model

> Identify what must be protected and how the agent can be manipulated or misused.

- **Assets:** <List data, credentials, money, systems, reputation, and human safety concerns>
- **Actors:** <List users, operators, external content authors, attackers, services, and agents>
- **Threats:** <Cover prompt injection, exfiltration, privilege escalation, fraud, destructive action, and unsafe advice>

## Identity and permissions

> Bind every action to an authenticated actor and current resource-level authority.

- **Identity:** <Define user, service, tenant, session, agent, and delegated identity>
- **Permission model:** <Map roles or attributes to tools, resources, actions, and environments>
- **Credential handling:** <Define issuance, scoping, storage, rotation, revocation, and audit>

## Approvals and safeguards

> Use deterministic controls and meaningful approval previews before consequential action.

- **Approval matrix:** <Map risk tiers to preview, confirmation, second reviewer, or prohibited status>
- **Runtime controls:** <Define allowlists, limits, sandboxing, validation, output filtering, and rate controls>
- **User control:** <Provide inspect, edit, cancel, undo, revoke, delete, and escalation paths>

## Verification and response

> Continuously test controls and prepare for containment and recovery.

- **Safety tests:** <List adversarial, cross-tenant, approval-bypass, data-leak, and unsafe-action cases>
- **Monitoring:** <Define high-risk action, denial, anomaly, policy, and audit signals>
- **Incident response:** <Define containment, credential revocation, evidence preservation, communication, and follow-up>

## Related AgentAtlas field guides

- [Safety and permissions](https://agentatlas.dev/topics/safety-permissions)
- [Human approval](https://agentatlas.dev/topics/human-approval)
- [Governance](https://agentatlas.dev/topics/governance)

## Primary references

- [Codex security](https://developers.openai.com/codex/security) — Operational authority boundaries enforced through sandboxing, permissions, approvals, and network controls.
- [Configure permissions](https://code.claude.com/docs/en/permissions) — Permission modes, explicit allow and deny rules, managed controls, and user approval for tool execution.
- [Human-in-the-loop](https://openai.github.io/openai-agents-python/human_in_the_loop/) — Approval-required tools, interruptions, rejection messages, persisted run state, resumption, and long-running approvals.
- [AGENTS.md specification](https://agents.md/) — Versioned repository instructions that make build, test, style, and contribution requirements available to agents.
- [GitHub Spec Kit](https://github.github.com/spec-kit/index.html) — Governed specification-driven workflows, quality checks, organizational principles, and traceability across delivery artifacts.

---

- Template version: 1.0.0
- Reviewed: 2026-07-26

Generated deterministically from reviewed AgentAtlas records.