Security model

Note

Specification: draft. Implemented in part in the source build. Remaining requirements and external validation are not complete.

The key words MUST, MUST NOT, REQUIRED, SHALL, SHALL NOT, SHOULD, SHOULD NOT, RECOMMENDED, NOT RECOMMENDED, MAY, and OPTIONAL in this document are to be interpreted as described in BCP 14 (RFC 2119, RFC 8174) when, and only when, they appear in all capitals.

Fail-closed

[SEC-001] Any failure, error, timeout, or unreadable policy MUST produce deny (ADR-0013).

[SEC-002] A failure that happens after a decision but before the adapter answers MUST also produce deny.

Deny wins

[SEC-003] A deny from any stage overrides every other result, including grants.

[SEC-004] When no rule matches, the decision is deny.

The agent is untrusted

[SEC-005] Anything the agent or a tool server supplies can make a decision stricter but never more permissive.

[SEC-006] Agent-supplied identity claims, tool annotations, and explanations are treated as untrusted input.

Gates

[SEC-007] The identity, capability, intent, and risk stages are gates: they may return deny, pending, or pass, but never allow.

[SEC-008] Only a policy rule or a grant may produce allow.

Built-in protected resources

[SEC-009] A built-in protected resource MUST never be made allowable for agents by policy (ADR-0016).

[SEC-010] Protected resources include Shiin’s own state, keys, and audit log, host hook configuration, and approval commands.

Determinism

[SEC-011] The same action request and the same policy snapshot always produce the same decision. No language-model or machine-learning output is an input to any decision (ADR-0009).

Honest coverage

[SEC-012] Every adapter states its enforcement level and what it cannot see (ADR-0033).

Sandboxes

[SEC-013] Shiin decides whether an action should happen. A sandbox limits the damage if an allowed action, or the code it runs, misbehaves.

Revision history

• v1-draft.1 (2026-10-01): Initial draft.