AssuranceReviewed Markdown template

SAFETY.md

Safety and permission system

Document threats, assets, identities, authority boundaries, least-privilege controls, approval policies, data protections, abuse cases, and incident response for agent behavior and tool use.

Download SAFETY.mdReview the fields

Fillable structure

Replace prompts with project evidence.

Remove any field that does not apply. A smaller maintained file is more useful than generic documentation that agents and reviewers cannot trust.

  1. 01

    Threat model

    Identify what must be protected and how the agent can be manipulated or misused.

    • Assets: List data, credentials, money, systems, reputation, and human safety concerns

    • Actors: List users, operators, external content authors, attackers, services, and agents

    • Threats: Cover prompt injection, exfiltration, privilege escalation, fraud, destructive action, and unsafe advice

  2. 02

    Identity and permissions

    Bind every action to an authenticated actor and current resource-level authority.

    • Identity: Define user, service, tenant, session, agent, and delegated identity

    • Permission model: Map roles or attributes to tools, resources, actions, and environments

    • Credential handling: Define issuance, scoping, storage, rotation, revocation, and audit

  3. 03

    Approvals and safeguards

    Use deterministic controls and meaningful approval previews before consequential action.

    • Approval matrix: Map risk tiers to preview, confirmation, second reviewer, or prohibited status

    • Runtime controls: Define allowlists, limits, sandboxing, validation, output filtering, and rate controls

    • User control: Provide inspect, edit, cancel, undo, revoke, delete, and escalation paths

  4. 04

    Verification and response

    Continuously test controls and prepare for containment and recovery.

    • Safety tests: List adversarial, cross-tenant, approval-bypass, data-leak, and unsafe-action cases

    • Monitoring: Define high-risk action, denial, anomaly, policy, and audit signals

    • Incident response: Define containment, credential revocation, evidence preservation, communication, and follow-up

Related field guides

Primary references

Next template

RUNBOOK.md · Agent operations runbook