Published rules
Each of these is written up in full in the attack library: where the pattern hides, how the rule is proven against a live product, and what the fix looks like.
Engineering approves every rule before it runs. A rule that breaks names the change that broke it, and the same check keeps running once the fix lands.
-
A user must never be able to read or act on another user’s object.
Executable checkFor every endpoint accepting an object identifier, a request carrying a foreign identifier must return 403 or 404, on every release.
How this rule is proven → -
A revoked session must stop working everywhere within one minute.
Executable checkAfter logout, password change and account removal, a captured token must be refused by every protected endpoint within one minute, on every release.
How this rule is proven → -
A metered operation must be reachable only through the flow that meters it, and no account may spend beyond its plan by any route.
Executable checkEvery expensive endpoint must reject a call made outside its metered flow, and a spend anomaly must page a human within fifteen minutes, on every release.
How this rule is proven → -
A response must contain only the fields the screen displays.
Executable checkEvery endpoint’s response must validate against an explicit field allow-list, with no token, secret or internal identifier present, on every release.
How this rule is proven → -
A recovery or signup flow must not reveal whether an account exists.
Executable checkReset, signup and login must return an identical response and comparable timing for known and unknown accounts, on every release.
How this rule is proven → -
Every input must have a documented upper bound, enforced server-side, and no single request may exceed a fixed budget of compute.
Executable checkEach cost-bearing endpoint must reject inputs beyond its documented bound and stay within its compute budget, on every release.
How this rule is proven → -
Content an outsider controls must never become an instruction the agent acts on.
Executable checkFor every agent, planted instructions in readable content must produce no tool call, and each agent must hold only its task’s permissions, on every release.
How this rule is proven →
Examples from the catalogue
Rules of this shape exist for each of the six categories. These are written as examples, so nothing here has been proven against a product yet; a real rule set is written for the product in front of it.
Your own set starts in week one of an audit and grows every time the loop finds something worth remembering.
- A user must never be able to act on another user's account.
- A revoked session must stop working everywhere within one minute.
- No connected app may read more than the scope it was granted.
- No account may spend more than its plan allows, by any route.
- A prompt endpoint must be reachable only through the product that owns it.
- A spend anomaly must page a human within fifteen minutes.
- A response must contain only the fields the screen displays.
- No secret may exist in a client bundle, log line or error page.
- An integration must receive only the data its function requires.
- A single actor must not be able to create more than N accounts an hour.
- A price must be computed server-side, never accepted from the client.
- A recovery flow must not reveal whether an account exists.
- No single request may consume more than a fixed budget of compute.
- Every input must have a documented upper bound, enforced server-side.
- Loss of any one provider must degrade the product, not stop it.
- Every handler must enforce ownership regardless of who or what wrote it.
- An agent must hold only the permissions its current task requires.
- Content an outsider controls must never become an instruction.
Where a rule comes from
A rule is written when something is worth keeping true: a pattern that applies to your product, an incident on the public record, or a path proven during an audit. It is one sentence, in language the whole team can read, with a check that decides it. Engineering approves it, and it runs from then on.