# Security — First Principles

## P1 — Boundary Validation
All input is validated at the trust boundary. (C1 Correctness)

## P2 — Least Privilege
Every identity has the minimum authority required. (C1, C8 Economy)

## P3 — Defense in Depth
Security controls are layered; no single control is the only barrier. (C1)

## P4 — Secrets Never Exposed
Secrets are never in code, logs, URLs, or error messages. (C1, C7 Observability)

## P5 — Authenticated by Default
Access is denied unless explicitly granted. (C1)

## P6 — Encrypted in Transit and at Rest
All data is encrypted in motion and at rest. (C1)

## P7 — Auditable Actions
Every security-relevant action is recorded with an authenticated principal. (C1, C7)

## P8 — Patched Dependencies
Dependencies are pinned and scanned for known vulnerabilities. (C1, C8)

## P9 — Isolated Blast Radius
Compromise of one component does not compromise the system. (C1, C6 Composability)

## P10 — Secure by Default
The secure configuration is the default; insecurity requires explicit opt-in. (C1)