# Security / Privacy / Compliance / Governance

> Every principle in this category is listed as a record.

Page: Ontology · Principles
Canonical: https://banes-lab.com/ontology#arch-category-security-privacy-compliance-governance

Every principle in this category is listed as a record. Each record carries its kind, its severity, the scopes it applies at and the layer it lives in, then the edge relations that join it to other records, the records that point back at it, the contracts that answer to it and the tensions it takes part in. The descriptors say how it is violated, detected, measured, repaired and enforced. Where the record carries one, an exemplar shows the shape before and after the principle is applied.

Relations diagram

The relations inside this category.

```mermaid
flowchart LR
n_security_by_design["Security by Design"]
n_defense_in_depth["Defense in Depth"]
n_least_privilege["Least Privilege"]
n_zero_trust_architecture["Zero Trust Architecture"]
n_secure_by_default["Secure by Default"]
n_attack_surface_reduction["Attack Surface Reduction"]
n_threat_modeling["Threat Modeling"]
n_authentication["Authentication"]
n_authorization["Authorization"]
n_access_control["Access Control"]
n_role_based_access_control["RBAC"]
n_attribute_based_access_control["ABAC"]
n_input_validation["Input Validation"]
n_output_encoding["Output Encoding"]
n_encryption_at_rest["Encryption at Rest"]
n_encryption_in_transit["Encryption in Transit"]
n_secrets_management["Secrets Management"]
n_privacy_by_design["Privacy by Design"]
n_compliance["Compliance"]
n_governance["Governance"]
n_policy_enforcement["Policy Enforcement"]
n_policy_as_code["Policy as Code"]
n_risk_management["Risk Management"]
n_continuous_compliance["Continuous Compliance"]
n_csrf_protection["CSRF Protection"]
n_parameterized_queries["Parameterized Queries"]
n_session_management["Session Management"]
n_security_by_design --> n_threat_modeling
n_security_by_design --> n_defense_in_depth
n_security_by_design --> n_compliance
n_defense_in_depth --> n_security_by_design
n_least_privilege --> n_access_control
n_zero_trust_architecture --> n_least_privilege
n_attack_surface_reduction --> n_security_by_design
n_threat_modeling --> n_security_by_design
n_threat_modeling --> n_risk_management
n_authentication --> n_access_control
n_authorization --> n_least_privilege
n_access_control --> n_least_privilege
n_role_based_access_control --> n_access_control
n_privacy_by_design --> n_compliance
n_compliance --> n_governance
n_compliance --> n_risk_management
n_governance --> n_compliance
n_policy_enforcement --> n_compliance
n_policy_as_code --> n_continuous_compliance
n_risk_management --> n_compliance
n_risk_management --> n_security_by_design
n_continuous_compliance --> n_policy_as_code
n_continuous_compliance --> n_compliance
n_csrf_protection --> n_authentication
n_csrf_protection --> n_defense_in_depth
n_parameterized_queries --> n_input_validation
n_parameterized_queries --> n_secure_by_default
n_session_management --> n_authentication
n_session_management --> n_access_control
n_session_management --> n_least_privilege
```

### Security by Design

- Kind: [principle](https://banes-lab.com/records/kind/principle.md)
- Severity: mandatory
- Scope: system, service, codebase
- Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md)

Details

Requires
[Threat Modeling](https://banes-lab.com/records/arch/threat-modeling.md), [Secure Defaults](https://banes-lab.com/records/lex/secure-defaults.md)

Reinforces
[Defense in Depth](https://banes-lab.com/records/arch/defense-in-depth.md), [Compliance](https://banes-lab.com/records/arch/compliance.md)

Enables
[Proactive Risk Reduction](https://banes-lab.com/records/lex/proactive-risk-reduction.md)

In tension with
[Developer Ergonomics](https://banes-lab.com/records/lex/developer-ergonomics.md)

Conflicts with
[Security as Afterthought](https://banes-lab.com/records/lex/security-as-afterthought.md)

Referenced by
[Fail Secure](https://banes-lab.com/records/arch/fail-secure.md), [Defense in Depth](https://banes-lab.com/records/arch/defense-in-depth.md), [Attack Surface Reduction](https://banes-lab.com/records/arch/attack-surface-reduction.md), [Threat Modeling](https://banes-lab.com/records/arch/threat-modeling.md), [Risk Management](https://banes-lab.com/records/arch/risk-management.md)

Tensions
[Security by Design Developer Ergonomics](https://banes-lab.com/records/tension/developer-ergonomics-security-by-design.md)

Violated by
security controls added only at perimeter

Detected by
missing authz/input validation/threat model

Measured by
security control coverage

Refactored by
Add Security Boundary, Validate Input, Enforce Access

Enforced by
security gates, [policy-as-code](https://banes-lab.com/records/arch/policy-as-code.md)

Before

```typescript
function createFoo(request: Request) {
return fooStore.save(request.body as Foo);
}
```

After

```typescript
function createFoo(request: Request, identity: Identity) {
const input = CreateFooSchema.parse(request.body);
authorize(identity, "foo:create");
return fooStore.save(Foo.create(input));
}
```

### Defense in Depth

- Kind: [principle](https://banes-lab.com/records/kind/principle.md)
- Severity: mandatory
- Scope: system, infrastructure, application
- Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md)

Details

Requires
[Layered Controls](https://banes-lab.com/records/lex/layered-controls.md)

Reinforces
[Security by Design](https://banes-lab.com/records/arch/security-by-design.md)

Enables
[Compromise Containment](https://banes-lab.com/records/lex/compromise-containment.md)

In tension with
[Complexity](https://banes-lab.com/records/lex/complexity.md)

Conflicts with
[Single Control Reliance](https://banes-lab.com/records/lex/single-control-reliance.md)

Referenced by
[Security by Design](https://banes-lab.com/records/arch/security-by-design.md), [CSRF Protection](https://banes-lab.com/records/arch/csrf-protection.md)

Tensions
[Defense in Depth Complexity](https://banes-lab.com/records/tension/complexity-defense-in-depth.md)

Violated by
relying on only one security layer

Detected by
missing secondary control

Measured by
control depth

Refactored by
Add Layered Controls

Enforced by
threat model review

Before

```typescript
app.post("/foo", createFoo);
```

After

```typescript
app.post("/foo",
authenticate(),
authorize("foo:create"),
validate(CreateFooSchema),
rateLimit({ limit: 100 }),
audit("FOO_CREATE"),
createFoo,
);
```

### Least Privilege

- Kind: [principle](https://banes-lab.com/records/kind/principle.md)
- Severity: mandatory
- Scope: user, service, process, data
- Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md)

Details

Requires
[Access Control](https://banes-lab.com/records/arch/access-control.md), [Minimal Permissions](https://banes-lab.com/records/lex/minimal-permissions.md)

Reinforces
[Zero Trust](https://banes-lab.com/records/lex/zero-trust.md), [Damage Limitation](https://banes-lab.com/records/lex/damage-limitation.md)

Enables
[Reduced Blast Radius](https://banes-lab.com/records/lex/reduced-blast-radius.md)

In tension with
[Operational Convenience](https://banes-lab.com/records/lex/operational-convenience.md)

Conflicts with
[Broad Admin Access](https://banes-lab.com/records/lex/broad-admin-access.md)

Referenced by
[Zero Trust Architecture](https://banes-lab.com/records/arch/zero-trust-architecture.md), [Authorization](https://banes-lab.com/records/arch/authorization.md), [Access Control](https://banes-lab.com/records/arch/access-control.md), [Session Management](https://banes-lab.com/records/arch/session-management.md)

Contracts
[Least Privilege Over Broad Privilege](https://banes-lab.com/records/algo/no-broad-privilege.md)

Tensions
[Least Privilege Operational Convenience](https://banes-lab.com/records/tension/least-privilege-operational-convenience.md)

Violated by
excessive permissions

Detected by
overbroad roles/scopes

Measured by
privilege excess count

Refactored by
Narrow Role, Split Permission

Enforced by
IAM policy checks

Before

```typescript
class FooJob {
constructor(private readonly db: AdminDatabase) {}
run(foo: Foo) { return this.db.execute(`insert into foo values (?)`, foo); }
}
```

After

```typescript
interface FooWriter { insert(foo: Foo): Promise<void>; }
class FooJob {
constructor(private readonly foos: FooWriter) {}
run(foo: Foo) { return this.foos.insert(foo); }
}
```

### Zero Trust Architecture

- Kind: [style](https://banes-lab.com/records/kind/style.md)
- Severity: contextual
- Scope: system, network, identity
- Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md)

Details

Requires
[Strong Identity](https://banes-lab.com/records/lex/strong-identity.md), [Continuous Authorization](https://banes-lab.com/records/lex/continuous-authorization.md)

Reinforces
[Least Privilege](https://banes-lab.com/records/arch/least-privilege.md)

Enables
[Perimeterless Security](https://banes-lab.com/records/lex/perimeterless-security.md)

In tension with
[Latency/Complexity](https://banes-lab.com/records/lex/latency-complexity.md)

Conflicts with
[Trusted Internal Network Assumption](https://banes-lab.com/records/lex/trusted-internal-network-assumption.md)

Tensions
[Zero Trust Architecture Latency/Complexity](https://banes-lab.com/records/tension/latency-complexity-zero-trust-architecture.md)

Violated by
implicit trust based on network location

Detected by
internal endpoints without authz/authn

Measured by
trustless control coverage

Refactored by
Add AuthN/AuthZ, Segment Network

Enforced by
[policy-as-code](https://banes-lab.com/records/arch/policy-as-code.md), gateway rules

Before

```typescript
if (request.network === "internal") return createFoo(request.body);
```

After

```typescript
const identity = authenticate(request.credentials);
authorize(identity, "foo:create", { resource: request.body.id });
verifyDevice(request.deviceAttestation);
return createFoo(CreateFooSchema.parse(request.body));
```

### Secure by Default

- Kind: [principle](https://banes-lab.com/records/kind/principle.md)
- Severity: mandatory
- Scope: configuration, API, product
- Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md)

Details

Requires
[Safe Defaults](https://banes-lab.com/records/lex/safe-defaults.md)

Reinforces
[Fail Secure](https://banes-lab.com/records/arch/fail-secure.md)

Enables
[Reduced Misconfiguration Risk](https://banes-lab.com/records/lex/reduced-misconfiguration-risk.md)

In tension with
[Ease of Initial Use](https://banes-lab.com/records/lex/ease-of-initial-use.md)

Conflicts with
[Insecure Defaults](https://banes-lab.com/records/lex/insecure-defaults.md)

Referenced by
[Parameterized Queries](https://banes-lab.com/records/arch/parameterized-queries.md)

Tensions
[Secure by Default Ease of Initial Use](https://banes-lab.com/records/tension/ease-of-initial-use-secure-by-default.md)

Violated by
default open access, default weak settings

Detected by
insecure default config

Measured by
insecure default count

Refactored by
Change Default to Secure, Require Explicit Opt-In

Enforced by
config policy

Before

```typescript
const fooApi = createApi({ public: true, tls: false, audit: false });
```

After

```typescript
const fooApi = createApi({
public: false,
tls: "required",
authentication: "required",
audit: true,
});
```

### Attack Surface Reduction

- Kind: [principle](https://banes-lab.com/records/kind/principle.md)
- Severity: mandatory
- Scope: API, service, infrastructure
- Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md)

Details

Requires
[Minimal Exposure](https://banes-lab.com/records/lex/minimal-exposure.md)

Reinforces
[Security by Design](https://banes-lab.com/records/arch/security-by-design.md)

Enables
[Reduced Exploitability](https://banes-lab.com/records/lex/reduced-exploitability.md)

In tension with
[Feature Exposure](https://banes-lab.com/records/lex/feature-exposure.md)

Conflicts with
[Unnecessary Public Surface](https://banes-lab.com/records/lex/unnecessary-public-surface.md)

Tensions
[Attack Surface Reduction Feature Exposure](https://banes-lab.com/records/tension/attack-surface-reduction-feature-exposure.md)

Violated by
unused open ports/endpoints/permissions

Detected by
exposed unused routes/services

Measured by
exposed surface count

Refactored by
Remove Endpoint, Restrict Access, Disable Feature

Enforced by
attack surface scanning

Before

```typescript
app.enableDebugConsole();
app.exposeAdminApi();
app.loadAllPlugins();
```

After

```typescript
app.register(fooPublicApi);
app.disable("debug-console");
app.disable("admin-api");
app.loadPlugins(approvedFooPlugins);
```

### Threat Modeling

- Kind: [activity](https://banes-lab.com/records/kind/activity.md)
- Severity: mandatory for sensitive systems
- Scope: feature, system, architecture
- Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md)

Details

Requires
[Assets](https://banes-lab.com/records/lex/assets.md), [Trust Boundaries](https://banes-lab.com/records/lex/trust-boundaries.md), [Threat Scenarios](https://banes-lab.com/records/lex/threat-scenarios.md)

Reinforces
[Security by Design](https://banes-lab.com/records/arch/security-by-design.md), [Risk Management](https://banes-lab.com/records/arch/risk-management.md)

Enables
[Control Selection](https://banes-lab.com/records/lex/control-selection.md)

In tension with
[Delivery Speed](https://banes-lab.com/records/lex/delivery-speed.md)

Conflicts with
[Assumption-Driven Security](https://banes-lab.com/records/lex/assumption-driven-security.md), [Security Theater](https://banes-lab.com/records/arch/security-theater.md)

Referenced by
[Security by Design](https://banes-lab.com/records/arch/security-by-design.md)

Tensions
[Threat Modeling Delivery Speed](https://banes-lab.com/records/tension/delivery-speed-threat-modeling.md)

Violated by
security-sensitive change without threat review

Detected by
missing threat model for sensitive flow

Measured by
threat model coverage

Refactored by
Add Threat Model, Add Mitigation

Enforced by
security review gates

Before

```typescript
designFooUpload();
shipFooUpload();
```

After

```typescript
const threats = modelThreats(fooUploadFlow, ["spoofing", "tampering", "repudiation", "disclosure", "denial", "elevation"]);
for (const threat of threats) requireMitigation(threat);
shipFooUpload();
```

### Authentication

- Kind: [mechanism](https://banes-lab.com/records/kind/mechanism.md)
- Severity: mandatory
- Scope: user, service, API
- Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md)

Details

Requires
[Identity Proof](https://banes-lab.com/records/lex/identity-proof.md)

Reinforces
[Access Control](https://banes-lab.com/records/arch/access-control.md)

Enables
[Identity-Aware Authorization](https://banes-lab.com/records/lex/identity-aware-authorization.md)

In tension with
[User Experience](https://banes-lab.com/records/lex/user-experience.md)

Conflicts with
[Anonymous Sensitive Access](https://banes-lab.com/records/lex/anonymous-sensitive-access.md)

Referenced by
[CSRF Protection](https://banes-lab.com/records/arch/csrf-protection.md), [Session Management](https://banes-lab.com/records/arch/session-management.md)

Tensions
[Authentication User Experience](https://banes-lab.com/records/tension/authentication-user-experience.md)

Violated by
sensitive action without identity verification

Detected by
unauthenticated protected endpoints

Measured by
auth coverage

Refactored by
Add AuthN Middleware/Provider

Enforced by
route policies, [tests](https://banes-lab.com/records/lex/tests.md)

Before

```typescript
const userId = request.headers.get("X-User-ID");
return loadFooFor(userId!);
```

After

```typescript
const credential = requireHeader(request, "Authorization");
const identity = await authenticator.verify(credential);
if (!identity) throw new UnauthorizedError();
return loadFooFor(identity.subject);
```

### Authorization

- Kind: [mechanism](https://banes-lab.com/records/kind/mechanism.md)
- Severity: mandatory
- Scope: API, domain action, data access
- Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md)

Details

Requires
[Authenticated Principal](https://banes-lab.com/records/lex/authenticated-principal.md), [Policy](https://banes-lab.com/records/lex/policy.md)

Reinforces
[Least Privilege](https://banes-lab.com/records/arch/least-privilege.md)

Enables
[Controlled Access](https://banes-lab.com/records/lex/controlled-access.md)

In tension with
[Policy Complexity](https://banes-lab.com/records/lex/policy-complexity.md)

Conflicts with
[Authenticated-Equals-Authorized](https://banes-lab.com/records/lex/authenticated-equals-authorized.md), [Authorization Scattering](https://banes-lab.com/records/arch/authorization-scattering.md)

Referenced by
[Proxy Pattern](https://banes-lab.com/records/arch/proxy-pattern.md)

Tensions
[Authorization Policy Complexity](https://banes-lab.com/records/tension/authorization-policy-complexity.md)

Violated by
missing permission check

Detected by
protected operation without authz guard

Measured by
authorization coverage

Refactored by
Add Policy Check, Centralize Authorization

Enforced by
security tests, [policy-as-code](https://banes-lab.com/records/arch/policy-as-code.md)

Before

```typescript
const identity = authenticate(request);
return fooStore.delete(request.params.id);
```

After

```typescript
const identity = authenticate(request);
authorize(identity, "foo:delete", { fooId: request.params.id });
return fooStore.delete(request.params.id);
```

### Access Control

- Kind: [mechanism](https://banes-lab.com/records/kind/mechanism.md)
- Severity: mandatory
- Scope: API, data, infrastructure
- Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md)

Details

Requires
[Authorization Policy](https://banes-lab.com/records/lex/authorization-policy.md)

Reinforces
[Least Privilege](https://banes-lab.com/records/arch/least-privilege.md)

Enables
[Resource Protection](https://banes-lab.com/records/lex/resource-protection.md)

In tension with
[Usability](https://banes-lab.com/records/lex/usability.md)

Conflicts with
[Unrestricted Access](https://banes-lab.com/records/lex/unrestricted-access.md)

Referenced by
[Centralized Configuration](https://banes-lab.com/records/arch/centralized-configuration.md), [Least Privilege](https://banes-lab.com/records/arch/least-privilege.md), [Authentication](https://banes-lab.com/records/arch/authentication.md), [RBAC](https://banes-lab.com/records/arch/role-based-access-control.md), [Session Management](https://banes-lab.com/records/arch/session-management.md)

Tensions
[Access Control Usability](https://banes-lab.com/records/tension/access-control-usability.md)

Violated by
broad or missing access controls

Detected by
resource endpoint lacking policy

Measured by
access control coverage

Refactored by
Add ACL/RBAC/ABAC Policy

Enforced by
policy tests

Before

```typescript
if (user.role === "admin") return fooStore.findAll();
```

After

```typescript
const decision = accessPolicy.evaluate({
subject: user,
action: "foo:list",
resource: { tenantId: request.tenantId },
});
if (!decision.allowed) throw new ForbiddenError();
return fooStore.findAll(request.tenantId);
```

### RBAC

- Kind: [model](https://banes-lab.com/records/kind/model.md)
- Severity: contextual
- Scope: user, role, resource
- Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md)

Details

Requires
[Role Definitions](https://banes-lab.com/records/lex/role-definitions.md)

Reinforces
[Access Control](https://banes-lab.com/records/arch/access-control.md)

Enables
[Coarse-Grained Permission Management](https://banes-lab.com/records/lex/coarse-grained-permission-management.md)

In tension with
[Role Explosion](https://banes-lab.com/records/lex/role-explosion.md)

Conflicts with
[Ad-Hoc Permission Checks](https://banes-lab.com/records/lex/ad-hoc-permission-checks.md)

Tensions
[RBAC Role Explosion](https://banes-lab.com/records/tension/rbac-role-explosion.md)

Violated by
hardcoded user-specific access logic

Detected by
scattered role checks

Measured by
role-policy consistency

Refactored by
Centralize Role Policy

Enforced by
authorization tests

Before

```typescript
if (user.name === "Developer") allowDeleteFoo();
```

After

```typescript
const roles = new Map([
["foo-reader", ["foo:read"]],
["foo-editor", ["foo:read", "foo:write"]],
["foo-admin", ["foo:read", "foo:write", "foo:delete"]],
]);
authorizeRole(user.roles, "foo:delete", roles);
```

### ABAC

- Kind: [model](https://banes-lab.com/records/kind/model.md)
- Severity: contextual
- Scope: user, resource, context
- Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md)

Details

Requires
[Attribute Definitions](https://banes-lab.com/records/lex/attribute-definitions.md), [Policy Engine](https://banes-lab.com/records/lex/policy-engine.md)

Reinforces
[Fine-Grained Access Control](https://banes-lab.com/records/lex/fine-grained-access-control.md)

Enables
[Context-Aware Authorization](https://banes-lab.com/records/lex/context-aware-authorization.md)

In tension with
[Policy Complexity](https://banes-lab.com/records/lex/policy-complexity.md)

Conflicts with
[Hardcoded Rules](https://banes-lab.com/records/lex/hardcoded-rules.md)

Tensions
[ABAC Policy Complexity](https://banes-lab.com/records/tension/abac-policy-complexity.md)

Violated by
complex access logic embedded in code

Detected by
duplicated attribute checks in handlers

Measured by
policy centralization

Refactored by
Extract Policy, Add Policy Engine

Enforced by
[policy-as-code](https://banes-lab.com/records/arch/policy-as-code.md)

Before

```typescript
if (user.role === "editor") return updateFoo(foo);
```

After

```typescript
const decision = policy.evaluate({
subject: { id: user.id, department: user.department },
action: "foo:update",
resource: { ownerId: foo.ownerId, classification: foo.classification },
environment: { time: clock.now() },
});
if (!decision.allowed) throw new ForbiddenError();
```

### Input Validation

- Kind: [mechanism](https://banes-lab.com/records/kind/mechanism.md)
- Severity: mandatory
- Scope: API, boundary, function
- Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md)

Details

Requires
[Validation Rules](https://banes-lab.com/records/lex/validation-rules.md), [Schema](https://banes-lab.com/records/lex/schema.md)

Reinforces
[Security](https://banes-lab.com/records/lex/security.md), [Correctness](https://banes-lab.com/records/arch/correctness.md)

Enables
[Fail Fast](https://banes-lab.com/records/arch/fail-fast.md)

In tension with
[Input Flexibility](https://banes-lab.com/records/lex/input-flexibility.md)

Conflicts with
[Trusting External Input](https://banes-lab.com/records/lex/trusting-external-input.md)

Referenced by
[Preconditions](https://banes-lab.com/records/arch/preconditions.md), [Defensive Programming](https://banes-lab.com/records/arch/defensive-programming.md), [Parameterized Queries](https://banes-lab.com/records/arch/parameterized-queries.md)

Contracts
[Boundary Validation Over Unvalidated Input](https://banes-lab.com/records/algo/no-unvalidated-input.md)

Tensions
[Input Validation Input Flexibility](https://banes-lab.com/records/tension/input-flexibility-input-validation.md)

Violated by
raw external data entering core logic

Detected by
missing boundary validators

Measured by
validation coverage

Refactored by
Add Validator, Add Schema

Enforced by
validation middleware, [tests](https://banes-lab.com/records/lex/tests.md)

Before

```typescript
const input = request.body as Foo;
fooStore.save(input);
```

After

```typescript
const input = CreateFooSchema.parse(request.body);
fooStore.save(input);
```

### Output Encoding

- Kind: [mechanism](https://banes-lab.com/records/kind/mechanism.md)
- Severity: mandatory
- Scope: UI, API, serialization
- Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md)

Details

Requires
[Context-Aware Encoding](https://banes-lab.com/records/lex/context-aware-encoding.md)

Reinforces
[Injection Prevention](https://banes-lab.com/records/lex/injection-prevention.md)

Enables
[Safe Rendering](https://banes-lab.com/records/lex/safe-rendering.md)

In tension with
[Formatting Flexibility](https://banes-lab.com/records/lex/formatting-flexibility.md)

Conflicts with
[Raw Output Rendering](https://banes-lab.com/records/lex/raw-output-rendering.md)

Tensions
[Output Encoding Formatting Flexibility](https://banes-lab.com/records/tension/formatting-flexibility-output-encoding.md)

Violated by
unescaped user-controlled output

Detected by
raw HTML/SQL/shell output paths

Measured by
unsafe sink count

Refactored by
Encode Output, Use Safe Templates

Enforced by
security linting

Before

```typescript
response.html(`<div>${foo.name}</div>`);
```

After

```typescript
response.html(`<div>${escapeHtml(foo.name)}</div>`);
```

### Encryption at Rest

- Kind: [mechanism](https://banes-lab.com/records/kind/mechanism.md)
- Severity: mandatory for sensitive data
- Scope: storage, database, backups
- Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md)

Details

Requires
[Key Management](https://banes-lab.com/records/lex/key-management.md)

Reinforces
[Data Protection](https://banes-lab.com/records/lex/data-protection.md)

Enables
[Confidentiality of Stored Data](https://banes-lab.com/records/lex/confidentiality-of-stored-data.md)

In tension with
[Key Operations](https://banes-lab.com/records/lex/key-operations.md)

Conflicts with
[Plaintext Sensitive Storage](https://banes-lab.com/records/lex/plaintext-sensitive-storage.md)

Tensions
[Encryption at Rest Key Operations](https://banes-lab.com/records/tension/encryption-at-rest-key-operations.md)

Violated by
sensitive data stored unencrypted

Detected by
storage config scan

Measured by
encrypted storage coverage

Refactored by
Enable Encryption, Add KMS

Enforced by
infrastructure policy

Before

```typescript
await disk.write("foos.json", JSON.stringify(foos));
```

After

```typescript
const ciphertext = await keyManager.encrypt("foo-data-key", JSON.stringify(foos));
await disk.write("foos.enc", ciphertext);
```

### Encryption in Transit

- Kind: [mechanism](https://banes-lab.com/records/kind/mechanism.md)
- Severity: mandatory
- Scope: network, service communication
- Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md)

Details

Requires
[TLS/mTLS](https://banes-lab.com/records/lex/tls-mtls.md)

Reinforces
[Confidentiality](https://banes-lab.com/records/lex/confidentiality.md), [Integrity](https://banes-lab.com/records/lex/integrity.md)

Enables
[Secure Communication](https://banes-lab.com/records/lex/secure-communication.md)

In tension with
[Certificate Management](https://banes-lab.com/records/lex/certificate-management.md)

Conflicts with
[Plaintext Transport](https://banes-lab.com/records/lex/plaintext-transport.md)

Tensions
[Encryption in Transit Certificate Management](https://banes-lab.com/records/tension/certificate-management-encryption-in-transit.md)

Violated by
sensitive traffic over plaintext

Detected by
HTTP/plain socket usage

Measured by
encrypted transport coverage

Refactored by
Enable TLS/mTLS

Enforced by
gateway/network policy

Before

```typescript
const client = new HttpClient("http://foo.internal");
```

After

```typescript
const client = new HttpClient("https://foo.internal", {
tls: { minVersion: "TLSv1.3", verifyPeer: true },
});
```

### Secrets Management

- Kind: [activity](https://banes-lab.com/records/kind/activity.md)
- Severity: mandatory
- Scope: config, deployment, runtime
- Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md)

Details

Requires
[Secret Store](https://banes-lab.com/records/lex/secret-store.md), [Rotation Policy](https://banes-lab.com/records/lex/rotation-policy.md)

Reinforces
[Secure Configuration](https://banes-lab.com/records/lex/secure-configuration.md)

Enables
[Safe Credential Handling](https://banes-lab.com/records/lex/safe-credential-handling.md)

In tension with
[Operational Complexity](https://banes-lab.com/records/lex/operational-complexity.md)

Conflicts with
[Hardcoded Secrets](https://banes-lab.com/records/lex/hardcoded-secrets.md), [Secret Sprawl](https://banes-lab.com/records/arch/secret-sprawl.md)

Contracts
[Secret Store Over Hardcoded Secrets](https://banes-lab.com/records/algo/no-hardcoded-secrets.md)

Tensions
[Secrets Management Operational Complexity](https://banes-lab.com/records/tension/operational-complexity-secrets-management.md)

Violated by
secrets in code/config files/logs

Detected by
secret scanning

Measured by
secret exposure count

Refactored by
Move to Secret Manager, Rotate Secret

Enforced by
secret scans, CI gates

Before

```typescript
const fooClient = new FooClient({ apiKey: "foo_live_abc123" });
```

After

```typescript
const apiKey = await secretStore.read("services/foo/api-key");
if (!apiKey) throw new Error("missing foo api key");
const fooClient = new FooClient({ apiKey });
```

### Privacy by Design

- Kind: [principle](https://banes-lab.com/records/kind/principle.md)
- Severity: mandatory for systems holding personal data
- Scope: data, product, system
- Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md)

Details

Requires
[Data Minimization](https://banes-lab.com/records/lex/data-minimization.md), [Consent/Policy](https://banes-lab.com/records/lex/consent-policy.md)

Reinforces
[Compliance](https://banes-lab.com/records/arch/compliance.md), [Security](https://banes-lab.com/records/lex/security.md)

Enables
[Privacy Compliance](https://banes-lab.com/records/lex/privacy-compliance.md)

In tension with
[Analytics/Personalization](https://banes-lab.com/records/lex/analytics-personalization.md)

Conflicts with
[Unbounded Data Collection](https://banes-lab.com/records/lex/unbounded-data-collection.md), [Personal Data Oversharing](https://banes-lab.com/records/arch/personal-data-oversharing.md)

Tensions
[Privacy by Design Analytics/Personalization](https://banes-lab.com/records/tension/analytics-personalization-privacy-by-design.md)

Violated by
collecting or retaining unnecessary personal data

Detected by
personal-data flow without policy

Measured by
personal-data surface, retention compliance

Refactored by
Minimize Data, Add Retention/Delete Controls

Enforced by
privacy review, [policy-as-code](https://banes-lab.com/records/arch/policy-as-code.md)

Before

```typescript
auditLog.append({ user, request, foo, headers: request.headers });
```

After

```typescript
auditLog.append({
actorId: pseudonymize(user.id),
action: "FOO_READ",
fooId: foo.id,
purpose: "support",
});
```

### Compliance

- Kind: [constraint](https://banes-lab.com/records/kind/constraint.md)
- Severity: contextual/mandatory when regulated
- Scope: system, organization, process
- Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md)

Details

Requires
[Controls](https://banes-lab.com/records/lex/controls.md), [Evidence](https://banes-lab.com/records/lex/evidence.md), [Auditability](https://banes-lab.com/records/arch/auditability.md)

Reinforces
[Governance](https://banes-lab.com/records/arch/governance.md), [Risk Management](https://banes-lab.com/records/arch/risk-management.md)

Enables
[Regulatory Alignment](https://banes-lab.com/records/lex/regulatory-alignment.md)

In tension with
[Delivery Speed](https://banes-lab.com/records/lex/delivery-speed.md)

Conflicts with
[Uncontrolled Change](https://banes-lab.com/records/lex/uncontrolled-change.md)

Referenced by
[Reproducibility](https://banes-lab.com/records/arch/reproducibility.md), [Model Governance](https://banes-lab.com/records/arch/model-governance.md), [Auditability](https://banes-lab.com/records/arch/auditability.md), [Standards Compliance](https://banes-lab.com/records/arch/standards-compliance.md), [Security by Design](https://banes-lab.com/records/arch/security-by-design.md), [Privacy by Design](https://banes-lab.com/records/arch/privacy-by-design.md), [Governance](https://banes-lab.com/records/arch/governance.md), [Policy Enforcement](https://banes-lab.com/records/arch/policy-enforcement.md), [Risk Management](https://banes-lab.com/records/arch/risk-management.md), [Continuous Compliance](https://banes-lab.com/records/arch/continuous-compliance.md)

Tensions
[Compliance Delivery Speed](https://banes-lab.com/records/tension/compliance-delivery-speed.md)

Violated by
missing controls/evidence for required regulation

Detected by
compliance gap assessment

Measured by
control pass rate

Refactored by
Add Control, Add Evidence Capture

Enforced by
compliance gates

Before

```typescript
storeFooData(foo);
```

After

```typescript
const classified = classify(foo);
const controls = compliance.requirements(classified, "foo-storage");
await enforceControls(controls);
await storeFooData(foo);
```

### Governance

- Kind: [principle](https://banes-lab.com/records/kind/principle.md)
- Severity: contextual
- Scope: organization, architecture, platform
- Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md)

Details

Requires
[Policy](https://banes-lab.com/records/lex/policy.md), [Standards](https://banes-lab.com/records/lex/standards.md), [Review](https://banes-lab.com/records/lex/review.md)

Reinforces
[Compliance](https://banes-lab.com/records/arch/compliance.md), [Consistency](https://banes-lab.com/records/arch/consistency.md)

Enables
[Controlled Evolution](https://banes-lab.com/records/lex/controlled-evolution.md)

In tension with
[Team Velocity](https://banes-lab.com/records/lex/team-velocity.md)

Conflicts with
[Unbounded Autonomy](https://banes-lab.com/records/lex/unbounded-autonomy.md)

Referenced by
[Assessment](https://banes-lab.com/records/arch/assessment.md), [Gap Analysis](https://banes-lab.com/records/arch/gap-analysis.md), [Architecture Decision Records (ADR)](https://banes-lab.com/records/arch/architecture-decision-records.md), [Architectural Consistency](https://banes-lab.com/records/arch/architectural-consistency.md), [Versioning](https://banes-lab.com/records/arch/versioning.md), [Control Plane](https://banes-lab.com/records/arch/control-plane.md), [Centralized Configuration](https://banes-lab.com/records/arch/centralized-configuration.md), [Centralized Authentication](https://banes-lab.com/records/arch/centralized-authentication.md), [Decentralization](https://banes-lab.com/records/arch/decentralization.md), [Autonomy](https://banes-lab.com/records/arch/autonomy.md), [Explicit Boundaries](https://banes-lab.com/records/arch/explicit-boundaries.md), [Explainability](https://banes-lab.com/records/arch/explainability.md), [Infrastructure as Code](https://banes-lab.com/records/arch/infrastructure-as-code.md), [Single Source of Truth](https://banes-lab.com/records/arch/single-source-of-truth.md), [Compliance](https://banes-lab.com/records/arch/compliance.md)

Tensions
[Governance Team Velocity](https://banes-lab.com/records/tension/governance-team-velocity.md)

Violated by
unmanaged architecture divergence

Detected by
standard violations, undocumented decisions

Measured by
policy compliance

Refactored by
Add Standards, Add Review Process

Enforced by
architecture board, [policy-as-code](https://banes-lab.com/records/arch/policy-as-code.md)

Before

```typescript
teams.defineFooApisIndependently();
```

After

```typescript
const governance = defineArchitecturePolicy({
apiVersioning: "required",
schemaRegistry: "required",
ownership: "single-team",
});
architectureGate.enforce(governance);
```

### Policy Enforcement

- Kind: [mechanism](https://banes-lab.com/records/kind/mechanism.md)
- Severity: mandatory
- Scope: code, infrastructure, runtime
- Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md)

Details

Requires
[Defined Policy](https://banes-lab.com/records/lex/defined-policy.md)

Reinforces
[Compliance](https://banes-lab.com/records/arch/compliance.md), [Security](https://banes-lab.com/records/lex/security.md)

Enables
[Automated Control](https://banes-lab.com/records/lex/automated-control.md)

In tension with
[False Positives](https://banes-lab.com/records/lex/false-positives.md)

Conflicts with
[Manual-Only Review](https://banes-lab.com/records/lex/manual-only-review.md)

Tensions
[Policy Enforcement False Positives](https://banes-lab.com/records/tension/false-positives-policy-enforcement.md)

Violated by
unenforced policy

Detected by
policy drift

Measured by
policy violation count

Refactored by
Codify Policy, Add Gate

Enforced by
CI/CD, runtime policy engine

Before

```typescript
if (!policyAllows(user, foo)) fooLog.record("policy violation");
return updateFoo(foo);
```

After

```typescript
if (!policyAllows(user, foo)) throw new ForbiddenError();
return updateFoo(foo);
```

### Policy as Code

- Kind: [mechanism](https://banes-lab.com/records/kind/mechanism.md)
- Severity: recommended
- Scope: infrastructure, deployment, security
- Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md)

Details

Requires
[Machine-Readable Policies](https://banes-lab.com/records/lex/machine-readable-policies.md)

Reinforces
[Continuous Compliance](https://banes-lab.com/records/arch/continuous-compliance.md)

Enables
[Automated Enforcement](https://banes-lab.com/records/lex/automated-enforcement.md)

In tension with
[Policy Maintenance](https://banes-lab.com/records/lex/policy-maintenance.md)

Conflicts with
[Document-Only Policy](https://banes-lab.com/records/lex/document-only-policy.md), [Manual-Only Governance](https://banes-lab.com/records/arch/manual-only-governance.md)

Referenced by
[Continuous Compliance](https://banes-lab.com/records/arch/continuous-compliance.md)

Tensions
[Policy as Code Policy Maintenance](https://banes-lab.com/records/tension/policy-as-code-policy-maintenance.md)

Violated by
manual policy checks not represented in code

Detected by
missing policy rule for known control

Measured by
automated policy coverage

Refactored by
Encode Policy, Add CI Gate

Enforced by
[policy engine](https://banes-lab.com/records/lex/policy-engine.md)

Before

```typescript
document.write("Only foo-admin may delete Foo");
```

After

```typescript
const fooDeletePolicy = policy({
action: "foo:delete",
allow: input => input.subject.roles.includes("foo-admin"),
});
policyGate.enforce(fooDeletePolicy);
```

### Risk Management

- Kind: [activity](https://banes-lab.com/records/kind/activity.md)
- Severity: contextual
- Scope: architecture, security, delivery
- Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md)

Details

Requires
[Risk Identification](https://banes-lab.com/records/lex/risk-identification.md), [Mitigation](https://banes-lab.com/records/lex/mitigation.md)

Reinforces
[Compliance](https://banes-lab.com/records/arch/compliance.md), [Security by Design](https://banes-lab.com/records/arch/security-by-design.md)

Enables
[Priority-Based Controls](https://banes-lab.com/records/lex/priority-based-controls.md)

In tension with
[Speed](https://banes-lab.com/records/lex/speed.md)

Conflicts with
[Unknown/Unowned Risk](https://banes-lab.com/records/lex/unknown-unowned-risk.md), [Unowned Risk](https://banes-lab.com/records/arch/unowned-risk.md)

Referenced by
[Threat Modeling](https://banes-lab.com/records/arch/threat-modeling.md), [Compliance](https://banes-lab.com/records/arch/compliance.md)

Tensions
[Risk Management Speed](https://banes-lab.com/records/tension/risk-management-speed.md)

Violated by
critical risk without owner/mitigation

Detected by
risk register gaps

Measured by
residual risk score

Refactored by
Add Mitigation, Reduce Exposure

Enforced by
review gates

Before

```typescript
shipFooFeature();
```

After

```typescript
const risk = assessRisk(fooFeature, {
likelihood: 3,
impact: 5,
controls: ["rate-limit", "audit", "rollback"],
});
if (risk.residual > riskTolerance) throw new Error("risk not accepted");
shipFooFeature();
```

### Continuous Compliance

- Kind: [capability](https://banes-lab.com/records/kind/capability.md)
- Severity: contextual
- Scope: CI/CD, infrastructure, codebase
- Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md)

Details

Requires
[Policy as Code](https://banes-lab.com/records/arch/policy-as-code.md), [Evidence Automation](https://banes-lab.com/records/lex/evidence-automation.md)

Reinforces
[Compliance](https://banes-lab.com/records/arch/compliance.md), [Auditability](https://banes-lab.com/records/arch/auditability.md)

Enables
[Ongoing Assurance](https://banes-lab.com/records/lex/ongoing-assurance.md)

In tension with
[Pipeline Complexity](https://banes-lab.com/records/lex/pipeline-complexity.md)

Conflicts with
[Point-in-Time Audit Only](https://banes-lab.com/records/lex/point-in-time-audit-only.md)

Referenced by
[Policy as Code](https://banes-lab.com/records/arch/policy-as-code.md)

Tensions
[Continuous Compliance Pipeline Complexity](https://banes-lab.com/records/tension/continuous-compliance-pipeline-complexity.md)

Violated by
compliance verified only manually/reactively

Detected by
missing automated compliance checks

Measured by
continuous control pass rate

Refactored by
Add Automated Evidence, Add Policy Gates

Enforced by
CI/CD controls

Before

```typescript
runComplianceAuditOncePerYear();
```

After

```typescript
pipeline.on("change", async change => {
const result = await complianceScanner.evaluate(change);
if (!result.compliant) throw new ComplianceGateError(result.violations);
});
```

### CSRF Protection

- Kind: [mechanism](https://banes-lab.com/records/kind/mechanism.md)
- Severity: mandatory for public APIs
- Scope: service, web, security
- Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md)

Details

Requires
[Request Origin Verification](https://banes-lab.com/records/lex/request-origin-verification.md)

Reinforces
[Authentication](https://banes-lab.com/records/arch/authentication.md), [Defense in Depth](https://banes-lab.com/records/arch/defense-in-depth.md)

Enables
[Forged-Request Rejection](https://banes-lab.com/records/lex/forged-request-rejection.md)

In tension with
[Client Complexity](https://banes-lab.com/records/lex/client-complexity.md)

Conflicts with
[Ambient-Credential Trust](https://banes-lab.com/records/lex/ambient-credential-trust.md)

Tensions
[CSRF Protection Client Complexity](https://banes-lab.com/records/tension/client-complexity-csrf-protection.md)

Violated by
state-changing requests trusted on cookie presence alone

Detected by
no anti-forgery token on mutating endpoints

Measured by
unprotected state-changing endpoint count

Refactored by
Add CSRF Tokens / SameSite Enforcement

Enforced by
security review

Before

```typescript
app.post("/foo/delete", deleteFoo);
```

After

```typescript
app.post("/foo/delete", verifyCsrfToken(), requireSameSite(), deleteFoo);
```

### Parameterized Queries

- Kind: [mechanism](https://banes-lab.com/records/kind/mechanism.md)
- Severity: mandatory
- Scope: service, database, security
- Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md)

Details

Requires
[Query Parameter Binding](https://banes-lab.com/records/lex/query-parameter-binding.md)

Reinforces
[Input Validation](https://banes-lab.com/records/arch/input-validation.md), [Secure by Default](https://banes-lab.com/records/arch/secure-by-default.md)

Enables
[Injection-Safe Data Access](https://banes-lab.com/records/lex/injection-safe-data-access.md)

In tension with
[Dynamic Query Flexibility](https://banes-lab.com/records/lex/dynamic-query-flexibility.md)

Conflicts with
[String-Concatenated SQL](https://banes-lab.com/records/lex/string-concatenated-sql.md)

Tensions
[Parameterized Queries Dynamic Query Flexibility](https://banes-lab.com/records/tension/dynamic-query-flexibility-parameterized-queries.md)

Violated by
SQL assembled by concatenating user input

Detected by
string interpolation into query text

Measured by
concatenated-query count

Refactored by
Use Parameterized Queries

Enforced by
security review

Before

```typescript
db.query(`select * from foos where id = '${id}'`);
```

After

```typescript
db.query("select * from foos where id = $1", [id]);
```

### Session Management

- Kind: [mechanism](https://banes-lab.com/records/kind/mechanism.md)
- Severity: mandatory for sensitive systems
- Scope: service, authentication, security
- Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md)

Details

Requires
[Authentication](https://banes-lab.com/records/arch/authentication.md)

Reinforces
[Access Control](https://banes-lab.com/records/arch/access-control.md), [Least Privilege](https://banes-lab.com/records/arch/least-privilege.md)

Enables
[Bounded Session Lifetime](https://banes-lab.com/records/lex/bounded-session-lifetime.md), [Revocable Access](https://banes-lab.com/records/lex/revocable-access.md)

In tension with
[User Convenience](https://banes-lab.com/records/lex/user-convenience.md)

Conflicts with
[Immortal Client-Trusted Session](https://banes-lab.com/records/lex/immortal-client-trusted-session.md)

Tensions
[Session Management User Convenience](https://banes-lab.com/records/tension/session-management-user-convenience.md)

Violated by
client-supplied identity trusted without server-side session

Detected by
no expiry/rotation/revocation on sessions

Measured by
unbounded-session count

Refactored by
Introduce Server-Side Session Management

Enforced by
security review

Before

```typescript
res.cookie("userId", user.id);
```

After

```typescript
const session = await sessions.create(user.id, { ttlMs: 3_600_000, rotateOnAuth: true });
res.cookie("sid", session.id, { httpOnly: true, secure: true, sameSite: "strict" });
```

## Links to

- [principle](https://banes-lab.com/records/kind/principle.md)
- [Security Core](https://banes-lab.com/records/layer/security-core.md)
- [Threat Modeling](https://banes-lab.com/records/arch/threat-modeling.md)
- [Secure Defaults](https://banes-lab.com/records/lex/secure-defaults.md)
- [Defense in Depth](https://banes-lab.com/records/arch/defense-in-depth.md)
- [Compliance](https://banes-lab.com/records/arch/compliance.md)
- [Proactive Risk Reduction](https://banes-lab.com/records/lex/proactive-risk-reduction.md)
- [Developer Ergonomics](https://banes-lab.com/records/lex/developer-ergonomics.md)
- [Security as Afterthought](https://banes-lab.com/records/lex/security-as-afterthought.md)
- [Fail Secure](https://banes-lab.com/records/arch/fail-secure.md)
- [Attack Surface Reduction](https://banes-lab.com/records/arch/attack-surface-reduction.md)
- [Risk Management](https://banes-lab.com/records/arch/risk-management.md)
- [Security by Design / Developer Ergonomics](https://banes-lab.com/records/tension/developer-ergonomics-security-by-design.md)
- [Policy as Code](https://banes-lab.com/records/arch/policy-as-code.md)
- [Layered Controls](https://banes-lab.com/records/lex/layered-controls.md)
- [Security by Design](https://banes-lab.com/records/arch/security-by-design.md)
- [Compromise Containment](https://banes-lab.com/records/lex/compromise-containment.md)
- [Complexity](https://banes-lab.com/records/lex/complexity.md)
- [Single Control Reliance](https://banes-lab.com/records/lex/single-control-reliance.md)
- [CSRF Protection](https://banes-lab.com/records/arch/csrf-protection.md)
- [Defense in Depth / Complexity](https://banes-lab.com/records/tension/complexity-defense-in-depth.md)
- [Access Control](https://banes-lab.com/records/arch/access-control.md)
- [Minimal Permissions](https://banes-lab.com/records/lex/minimal-permissions.md)
- [Zero Trust](https://banes-lab.com/records/lex/zero-trust.md)
- [Damage Limitation](https://banes-lab.com/records/lex/damage-limitation.md)
- [Reduced Blast Radius](https://banes-lab.com/records/lex/reduced-blast-radius.md)
- [Operational Convenience](https://banes-lab.com/records/lex/operational-convenience.md)
- [Broad Admin Access](https://banes-lab.com/records/lex/broad-admin-access.md)
- [Zero Trust Architecture](https://banes-lab.com/records/arch/zero-trust-architecture.md)
- [Authorization](https://banes-lab.com/records/arch/authorization.md)
- [Session Management](https://banes-lab.com/records/arch/session-management.md)
- [Least Privilege Over Broad Privilege](https://banes-lab.com/records/algo/no-broad-privilege.md)
- [Least Privilege / Operational Convenience](https://banes-lab.com/records/tension/least-privilege-operational-convenience.md)
- [style](https://banes-lab.com/records/kind/style.md)
- [Strong Identity](https://banes-lab.com/records/lex/strong-identity.md)
- [Continuous Authorization](https://banes-lab.com/records/lex/continuous-authorization.md)
- [Least Privilege](https://banes-lab.com/records/arch/least-privilege.md)
- [Perimeterless Security](https://banes-lab.com/records/lex/perimeterless-security.md)
- [Latency/Complexity](https://banes-lab.com/records/lex/latency-complexity.md)
- [Trusted Internal Network Assumption](https://banes-lab.com/records/lex/trusted-internal-network-assumption.md)
- [Zero Trust Architecture / Latency/Complexity](https://banes-lab.com/records/tension/latency-complexity-zero-trust-architecture.md)
- [Safe Defaults](https://banes-lab.com/records/lex/safe-defaults.md)
- [Reduced Misconfiguration Risk](https://banes-lab.com/records/lex/reduced-misconfiguration-risk.md)
- [Ease of Initial Use](https://banes-lab.com/records/lex/ease-of-initial-use.md)
- [Insecure Defaults](https://banes-lab.com/records/lex/insecure-defaults.md)
- [Parameterized Queries](https://banes-lab.com/records/arch/parameterized-queries.md)
- [Secure by Default / Ease of Initial Use](https://banes-lab.com/records/tension/ease-of-initial-use-secure-by-default.md)
- [Minimal Exposure](https://banes-lab.com/records/lex/minimal-exposure.md)
- [Reduced Exploitability](https://banes-lab.com/records/lex/reduced-exploitability.md)
- [Feature Exposure](https://banes-lab.com/records/lex/feature-exposure.md)
- [Unnecessary Public Surface](https://banes-lab.com/records/lex/unnecessary-public-surface.md)
- [Attack Surface Reduction / Feature Exposure](https://banes-lab.com/records/tension/attack-surface-reduction-feature-exposure.md)
- [activity](https://banes-lab.com/records/kind/activity.md)
- [Assets](https://banes-lab.com/records/lex/assets.md)
- [Trust Boundaries](https://banes-lab.com/records/lex/trust-boundaries.md)
- [Threat Scenarios](https://banes-lab.com/records/lex/threat-scenarios.md)
- [Control Selection](https://banes-lab.com/records/lex/control-selection.md)
- [Delivery Speed](https://banes-lab.com/records/lex/delivery-speed.md)
- [Assumption-Driven Security](https://banes-lab.com/records/lex/assumption-driven-security.md)
- [Security Theater](https://banes-lab.com/records/arch/security-theater.md)
- [Threat Modeling / Delivery Speed](https://banes-lab.com/records/tension/delivery-speed-threat-modeling.md)
- [mechanism](https://banes-lab.com/records/kind/mechanism.md)
- [Identity Proof](https://banes-lab.com/records/lex/identity-proof.md)
- [Identity-Aware Authorization](https://banes-lab.com/records/lex/identity-aware-authorization.md)
- [User Experience](https://banes-lab.com/records/lex/user-experience.md)
- [Anonymous Sensitive Access](https://banes-lab.com/records/lex/anonymous-sensitive-access.md)
- [Authentication / User Experience](https://banes-lab.com/records/tension/authentication-user-experience.md)
- [Tests](https://banes-lab.com/records/lex/tests.md)
- [Authenticated Principal](https://banes-lab.com/records/lex/authenticated-principal.md)
- [Policy](https://banes-lab.com/records/lex/policy.md)
- [Controlled Access](https://banes-lab.com/records/lex/controlled-access.md)
- [Policy Complexity](https://banes-lab.com/records/lex/policy-complexity.md)
- [Authenticated-Equals-Authorized](https://banes-lab.com/records/lex/authenticated-equals-authorized.md)
- [Authorization Scattering](https://banes-lab.com/records/arch/authorization-scattering.md)
- [Proxy Pattern](https://banes-lab.com/records/arch/proxy-pattern.md)
- [Authorization / Policy Complexity](https://banes-lab.com/records/tension/authorization-policy-complexity.md)
- [Authorization Policy](https://banes-lab.com/records/lex/authorization-policy.md)
- [Resource Protection](https://banes-lab.com/records/lex/resource-protection.md)
- [Usability](https://banes-lab.com/records/lex/usability.md)
- [Unrestricted Access](https://banes-lab.com/records/lex/unrestricted-access.md)
- [Centralized Configuration](https://banes-lab.com/records/arch/centralized-configuration.md)
- [Authentication](https://banes-lab.com/records/arch/authentication.md)
- [RBAC](https://banes-lab.com/records/arch/role-based-access-control.md)
- [Access Control / Usability](https://banes-lab.com/records/tension/access-control-usability.md)
- [model](https://banes-lab.com/records/kind/model.md)
- [Role Definitions](https://banes-lab.com/records/lex/role-definitions.md)
- [Coarse-Grained Permission Management](https://banes-lab.com/records/lex/coarse-grained-permission-management.md)
- [Role Explosion](https://banes-lab.com/records/lex/role-explosion.md)
- [Ad-Hoc Permission Checks](https://banes-lab.com/records/lex/ad-hoc-permission-checks.md)
- [RBAC / Role Explosion](https://banes-lab.com/records/tension/rbac-role-explosion.md)
- [Attribute Definitions](https://banes-lab.com/records/lex/attribute-definitions.md)
- [Policy Engine](https://banes-lab.com/records/lex/policy-engine.md)
- [Fine-Grained Access Control](https://banes-lab.com/records/lex/fine-grained-access-control.md)
- [Context-Aware Authorization](https://banes-lab.com/records/lex/context-aware-authorization.md)
- [Hardcoded Rules](https://banes-lab.com/records/lex/hardcoded-rules.md)
- [ABAC / Policy Complexity](https://banes-lab.com/records/tension/abac-policy-complexity.md)
- [Validation Rules](https://banes-lab.com/records/lex/validation-rules.md)
- [Schema](https://banes-lab.com/records/lex/schema.md)
- [Security](https://banes-lab.com/records/lex/security.md)
- [Correctness](https://banes-lab.com/records/arch/correctness.md)
- [Fail Fast](https://banes-lab.com/records/arch/fail-fast.md)
- [Input Flexibility](https://banes-lab.com/records/lex/input-flexibility.md)
- [Trusting External Input](https://banes-lab.com/records/lex/trusting-external-input.md)
- [Preconditions](https://banes-lab.com/records/arch/preconditions.md)
- [Defensive Programming](https://banes-lab.com/records/arch/defensive-programming.md)
- [Boundary Validation Over Unvalidated Input](https://banes-lab.com/records/algo/no-unvalidated-input.md)
- [Input Validation / Input Flexibility](https://banes-lab.com/records/tension/input-flexibility-input-validation.md)
- [Context-Aware Encoding](https://banes-lab.com/records/lex/context-aware-encoding.md)
- [Injection Prevention](https://banes-lab.com/records/lex/injection-prevention.md)
- [Safe Rendering](https://banes-lab.com/records/lex/safe-rendering.md)
- [Formatting Flexibility](https://banes-lab.com/records/lex/formatting-flexibility.md)
- [Raw Output Rendering](https://banes-lab.com/records/lex/raw-output-rendering.md)
- [Output Encoding / Formatting Flexibility](https://banes-lab.com/records/tension/formatting-flexibility-output-encoding.md)
- [Key Management](https://banes-lab.com/records/lex/key-management.md)
- [Data Protection](https://banes-lab.com/records/lex/data-protection.md)
- [Confidentiality of Stored Data](https://banes-lab.com/records/lex/confidentiality-of-stored-data.md)
- [Key Operations](https://banes-lab.com/records/lex/key-operations.md)
- [Plaintext Sensitive Storage](https://banes-lab.com/records/lex/plaintext-sensitive-storage.md)
- [Encryption at Rest / Key Operations](https://banes-lab.com/records/tension/encryption-at-rest-key-operations.md)
- [TLS/mTLS](https://banes-lab.com/records/lex/tls-mtls.md)
- [Confidentiality](https://banes-lab.com/records/lex/confidentiality.md)
- [Integrity](https://banes-lab.com/records/lex/integrity.md)
- [Secure Communication](https://banes-lab.com/records/lex/secure-communication.md)
- [Certificate Management](https://banes-lab.com/records/lex/certificate-management.md)
- [Plaintext Transport](https://banes-lab.com/records/lex/plaintext-transport.md)
- [Encryption in Transit / Certificate Management](https://banes-lab.com/records/tension/certificate-management-encryption-in-transit.md)
- [Secret Store](https://banes-lab.com/records/lex/secret-store.md)
- [Rotation Policy](https://banes-lab.com/records/lex/rotation-policy.md)
- [Secure Configuration](https://banes-lab.com/records/lex/secure-configuration.md)
- [Safe Credential Handling](https://banes-lab.com/records/lex/safe-credential-handling.md)
- [Operational Complexity](https://banes-lab.com/records/lex/operational-complexity.md)
- [Hardcoded Secrets](https://banes-lab.com/records/lex/hardcoded-secrets.md)
- [Secret Sprawl](https://banes-lab.com/records/arch/secret-sprawl.md)
- [Secret Store Over Hardcoded Secrets](https://banes-lab.com/records/algo/no-hardcoded-secrets.md)
- [Secrets Management / Operational Complexity](https://banes-lab.com/records/tension/operational-complexity-secrets-management.md)
- [Data Minimization](https://banes-lab.com/records/lex/data-minimization.md)
- [Consent/Policy](https://banes-lab.com/records/lex/consent-policy.md)
- [Privacy Compliance](https://banes-lab.com/records/lex/privacy-compliance.md)
- [Analytics/Personalization](https://banes-lab.com/records/lex/analytics-personalization.md)
- [Unbounded Data Collection](https://banes-lab.com/records/lex/unbounded-data-collection.md)
- [Personal Data Oversharing](https://banes-lab.com/records/arch/personal-data-oversharing.md)
- [Privacy by Design / Analytics/Personalization](https://banes-lab.com/records/tension/analytics-personalization-privacy-by-design.md)
- [constraint](https://banes-lab.com/records/kind/constraint.md)
- [Controls](https://banes-lab.com/records/lex/controls.md)
- [Evidence](https://banes-lab.com/records/lex/evidence.md)
- [Auditability](https://banes-lab.com/records/arch/auditability.md)
- [Governance](https://banes-lab.com/records/arch/governance.md)
- [Regulatory Alignment](https://banes-lab.com/records/lex/regulatory-alignment.md)
- [Uncontrolled Change](https://banes-lab.com/records/lex/uncontrolled-change.md)
- [Reproducibility](https://banes-lab.com/records/arch/reproducibility.md)
- [Model Governance](https://banes-lab.com/records/arch/model-governance.md)
- [Standards Compliance](https://banes-lab.com/records/arch/standards-compliance.md)
- [Privacy by Design](https://banes-lab.com/records/arch/privacy-by-design.md)
- [Policy Enforcement](https://banes-lab.com/records/arch/policy-enforcement.md)
- [Continuous Compliance](https://banes-lab.com/records/arch/continuous-compliance.md)
- [Compliance / Delivery Speed](https://banes-lab.com/records/tension/compliance-delivery-speed.md)
- [Standards](https://banes-lab.com/records/lex/standards.md)
- [Review](https://banes-lab.com/records/lex/review.md)
- [Consistency](https://banes-lab.com/records/arch/consistency.md)
- [Controlled Evolution](https://banes-lab.com/records/lex/controlled-evolution.md)
- [Team Velocity](https://banes-lab.com/records/lex/team-velocity.md)
- [Unbounded Autonomy](https://banes-lab.com/records/lex/unbounded-autonomy.md)
- [Assessment](https://banes-lab.com/records/arch/assessment.md)
- [Gap Analysis](https://banes-lab.com/records/arch/gap-analysis.md)
- [Architecture Decision Records (ADR)](https://banes-lab.com/records/arch/architecture-decision-records.md)
- [Architectural Consistency](https://banes-lab.com/records/arch/architectural-consistency.md)
- [Versioning](https://banes-lab.com/records/arch/versioning.md)
- [Control Plane](https://banes-lab.com/records/arch/control-plane.md)
- [Centralized Authentication](https://banes-lab.com/records/arch/centralized-authentication.md)
- [Decentralization](https://banes-lab.com/records/arch/decentralization.md)
- [Autonomy](https://banes-lab.com/records/arch/autonomy.md)
- [Explicit Boundaries](https://banes-lab.com/records/arch/explicit-boundaries.md)
- [Explainability](https://banes-lab.com/records/arch/explainability.md)
- [Infrastructure as Code](https://banes-lab.com/records/arch/infrastructure-as-code.md)
- [Single Source of Truth](https://banes-lab.com/records/arch/single-source-of-truth.md)
- [Governance / Team Velocity](https://banes-lab.com/records/tension/governance-team-velocity.md)
- [Defined Policy](https://banes-lab.com/records/lex/defined-policy.md)
- [Automated Control](https://banes-lab.com/records/lex/automated-control.md)
- [False Positives](https://banes-lab.com/records/lex/false-positives.md)
- [Manual-Only Review](https://banes-lab.com/records/lex/manual-only-review.md)
- [Policy Enforcement / False Positives](https://banes-lab.com/records/tension/false-positives-policy-enforcement.md)
- [Machine-Readable Policies](https://banes-lab.com/records/lex/machine-readable-policies.md)
- [Automated Enforcement](https://banes-lab.com/records/lex/automated-enforcement.md)
- [Policy Maintenance](https://banes-lab.com/records/lex/policy-maintenance.md)
- [Document-Only Policy](https://banes-lab.com/records/lex/document-only-policy.md)
- [Manual-Only Governance](https://banes-lab.com/records/arch/manual-only-governance.md)
- [Policy as Code / Policy Maintenance](https://banes-lab.com/records/tension/policy-as-code-policy-maintenance.md)
- [Risk Identification](https://banes-lab.com/records/lex/risk-identification.md)
- [Mitigation](https://banes-lab.com/records/lex/mitigation.md)
- [Priority-Based Controls](https://banes-lab.com/records/lex/priority-based-controls.md)
- [Speed](https://banes-lab.com/records/lex/speed.md)
- [Unknown/Unowned Risk](https://banes-lab.com/records/lex/unknown-unowned-risk.md)
- [Unowned Risk](https://banes-lab.com/records/arch/unowned-risk.md)
- [Risk Management / Speed](https://banes-lab.com/records/tension/risk-management-speed.md)
- [capability](https://banes-lab.com/records/kind/capability.md)
- [Evidence Automation](https://banes-lab.com/records/lex/evidence-automation.md)
- [Ongoing Assurance](https://banes-lab.com/records/lex/ongoing-assurance.md)
- [Pipeline Complexity](https://banes-lab.com/records/lex/pipeline-complexity.md)
- [Point-in-Time Audit Only](https://banes-lab.com/records/lex/point-in-time-audit-only.md)
- [Continuous Compliance / Pipeline Complexity](https://banes-lab.com/records/tension/continuous-compliance-pipeline-complexity.md)
- [Request Origin Verification](https://banes-lab.com/records/lex/request-origin-verification.md)
- [Forged-Request Rejection](https://banes-lab.com/records/lex/forged-request-rejection.md)
- [Client Complexity](https://banes-lab.com/records/lex/client-complexity.md)
- [Ambient-Credential Trust](https://banes-lab.com/records/lex/ambient-credential-trust.md)
- [CSRF Protection / Client Complexity](https://banes-lab.com/records/tension/client-complexity-csrf-protection.md)
- [Query Parameter Binding](https://banes-lab.com/records/lex/query-parameter-binding.md)
- [Input Validation](https://banes-lab.com/records/arch/input-validation.md)
- [Secure by Default](https://banes-lab.com/records/arch/secure-by-default.md)
- [Injection-Safe Data Access](https://banes-lab.com/records/lex/injection-safe-data-access.md)
- [Dynamic Query Flexibility](https://banes-lab.com/records/lex/dynamic-query-flexibility.md)
- [String-Concatenated SQL](https://banes-lab.com/records/lex/string-concatenated-sql.md)
- [Parameterized Queries / Dynamic Query Flexibility](https://banes-lab.com/records/tension/dynamic-query-flexibility-parameterized-queries.md)
- [Bounded Session Lifetime](https://banes-lab.com/records/lex/bounded-session-lifetime.md)
- [Revocable Access](https://banes-lab.com/records/lex/revocable-access.md)
- [User Convenience](https://banes-lab.com/records/lex/user-convenience.md)
- [Immortal Client-Trusted Session](https://banes-lab.com/records/lex/immortal-client-trusted-session.md)
- [Session Management / User Convenience](https://banes-lab.com/records/tension/session-management-user-convenience.md)

## Linked from

- [The layer topology](https://banes-lab.com/ontology/schema/the-layer-topology.md)
- [The membership](https://banes-lab.com/ontology/schema/the-membership.md)