Softanza
StartFrançais
Softanza
StartFrançais
I/O, formats, extensibility, media

Security & governance

A governance doctrine, an LLM cannot act effectfully by construction, plus identity, a durable tamper-evident ledger and a measured response.

6 Strong · 5 Solid · 0 Partial · 1 Emerging

Measured against: OWASP · Vault · OPA · semgrep · Folders: base/security(opens in a new tab) · For programmers: this area's reference

a chain of five blocks that cannot be rewritten, each hashed by the engine
a chain of five blocks that cannot be rewritten, each hashed by the engine. drawn on 2026-10-01 by the site's script tools/areas-figurative.ring, run inside the library at commit 0e72e2e2c · the source(opens in a new tab)

Rethought from first principles

What Softanza kept from what works, and what it rethought, as the library wrote it down in its design documents and narrations.

The Softanza wayExpression is free, admission is governed: anyone may compose and propose, but only an actor entitled to cause effects may commit.

Kept from the best practice

  • The threat model is read through recognised norms: the OWASP Top 10 lists for web, language-model and agent applications, and NIST CSF 2.0, as lenses, not verdicts. source(opens in a new tab)
  • Proven cryptography, not home-made: passwords are stored with Argon2id, and data at rest is sealed with authenticated encryption, so one altered byte opens nothing. source(opens in a new tab)
  • Safe defaults at every boundary: TLS checks the peer unless told otherwise by name, SQL values are bound and never spliced, and arguments start a program without a shell. source(opens in a new tab)

Rethought

  • Softanza assumes a manipulated prompt will get through, and makes it harmless: a language model never holds the capability to act, so a fooled model still cannot act. source(opens in a new tab)
  • Four capability kinds and three trust postures decide alike who may write a file, deploy, or read a key: one mechanism, not many. source(opens in a new tab)
  • A secret is a pointer to where the key lives. Its printed form is its own redaction, so no log or dump can leak the value. source(opens in a new tab)
  • A guarantee is listed only with the test that proves it, and a meta-test fails if that test is missing. Gaps without a test are named as open risks. source(opens in a new tab)

Most security stacks are a bag of primitives; Softanza's is a doctrine. One capability lattice (effectful, sensing, compute, inference) and three postures gate every dangerous act uniformly, so an LLM actor holding inference only is refused a secret, a file write or a deployment by construction. On top sit a full identity stack (OIDC, SAML, WebAuthn, both sides) and an engine-computed tamper-evident audit ledger; the gaps are a unified injection-defense surface, the unbuilt plugin governance, and the absence of a formal threat-model document.

What a crafter does with it, and what stands out

  • A governance doctrine enforced uniformly: an LLM actor holding only inference is refused by construction, not by a rule someone remembered to write
  • An engine-computed tamper-evident audit ledger (hash-chained, seal and verify)
  • A full identity stack: OIDC, SAML and WebAuthn on both sides
  • Multi-hop escalation caught by graph reachability (ReachesEffectful, BlastRadius)

What is owed

  • A unified injection-defense surface (the OWASP Top-10 core)
  • Authenticated symmetric encryption (AES-GCM / ChaCha20-Poly1305) and a modern KDF (Argon2)
  • A formal threat model mapped to guards
  • Plugin / foreign-capability governance, plus a shipped Vault/KMS backend adapter

The Softanza way, run

What Softanza does differently in this area, shown by code taken from its narrations and guards, and run for this page.

The articles of this area (14)

The lanes, one by one

Lanes and their notes are quoted as they were read at the source, on Read from the source on 2026-09-16 -- base/security (25 files) and base/governance; engine crypto.zig, seclog.zig, webauthn.zig, xmldsig.zig + vendored mbedTLS; plan of record doc/design/SOFTANZA_SECURITY.md.

Two readings. The Atlas card (v21, 2026-09-30) says 6 Strong, 5 Solid, 0 Partial, 1 Emerging; the group page, read Read from the source on 2026-09-16 -- base/security (25 files) and base/governance; engine crypto.zig, seclog.zig, webauthn.zig, xmldsig.zig + vendored mbedTLS; plan of record doc/design/SOFTANZA_SECURITY.md, rates its lanes 3, 6, 2, 1. The lanes below are the group page's; the card is the more recent reading.

Safe-world & capability governance
Strong
One capability lattice (effectful/sensing/compute/inference) and three postures enforce six checkpoints; agents rehearse in a stzVirtualFileSystem twinStzCheckNoLLMEffectful; stzUpdatePlan under three gates
Identity -- authn & authz
Strong
stzAuth sessions, TOTP, WebAuthn passkeys, OIDC client and provider, SAML SP and IdP, HMAC request signing with nonce replay cache; ~417 guarded assertions~417 identity assertions under test/system
Tamper-evident audit ledger
Strong
stzSecurityLedger over seclog.zig: a bounded hash-chained circular buffer whose digest is computed in-engine; seal-to-file, verify names a broken linkengine/src/seclog.zig
Cryptographic primitives
Solid
crypto.zig ships SHA-256, HMAC, PBKDF2, constant-time compare, CSPRNG, TOTP, ES256/RS256; RSA/X.509 via vendored mbedTLS; no AEAD, no Argon2engine crypto.zig + vendored mbedTLS
Secret storage & keyring
Solid
stzSecretStore is the one governed door: every Reveal(name, actor) is gated and audited, secrets self-redact; no real backend adapter shipsstzVaultResolver (in-memory reference only)
Policy governance & security rules
Solid
stzSecurityGraph answers ReachesEffectful, BlastRadius and PathExists, catching multi-hop escalation; only three security rules shipstzSecurityRule -> stzRuleReport
Events, redaction & OCSF telemetry
Solid
stzSecurityEvent is a typed record with a MITRE ATT&CK field and OCSF JSON export; redaction is enforced at construction; no PII/DLP surface
Detection & incident response
Solid
stzDetection -> stzSecuritySentinel -> stzIncident -> stzResponsePlan -> stzSecurityDrill; three detection shapes, no anomaly/ML, no Sigma interopstzSecurityDrill (adversary emulation vs a real spawned app)
Attestation & evidence custody
Solid
stzSecurityAttestation makes a custody statement over a sealed ledger; export is a sensing act an LLM may not perform; no in-toto interop yet
TLS / transport security
Partial
mTLS and TLS ride vendored mbedTLS with a smoke guard and fuzz_tls.zig; no cert-lifecycle management, OCSP or cipher-policy governancetest/cluster/mtls_narrated; engine fuzz_tls.zig
Input validation & injection defense
Partial
Primitives exist scattered (HTML/URL escaping in encode.zig, XXE closed by the XML parser); no unified validation surface, no SQLi/CSRF/XSS toolkitengine encode.zig
Plugin / foreign-capability governance
Emerging
A designed doctrine ('a plugin is a governed foreign capability') with a plan and comparative study; base/plugin is not loaded in stzBaseSOFTANZA_PLUGIN_PLAN.md