Security Policies & Legal Agreements
Relevant source files
The following files were used as context for generating this wiki page:
Security Policies & Legal Agreements in Isabella establish the normative and technical framework for territorial cognitive infrastructure. These documents and code-level enforcements ensure that the system operates under sovereign control, follows Zero-Trust principles, and complies with quadruple licensing requirements. The project integrates legal requirements directly into the runtime through modules like risk.ts and human-approval.ts.
Sources: legal/README.md:1-5, governance/README.md:1-6
Licensing Framework
Isabella utilizes a quadruple licensing model to separate open-source code from commercial, content, and documentation assets. This structure allows for public contribution while protecting territorial assets and commercial rights.
| Directory | Coverage | License |
|---|---|---|
LICENSES/CODE/ | Source Code | Apache License 2.0 |
LICENSES/COMMERCIAL/ | Commercial Software Use | Proprietary Commercial License |
LICENSES/CONTENT/ | Activations & Content (e.g., Isabella Sounds) | CC BY-NC-ND / Activation |
LICENSES/DOCS/ | Documentation & Framework Docs | CC BY 4.0 |
Sources: legal/README.md:7-14, legal/LICENSES/DOCS/README.md:3-6
Contributor Obligations
Contributors must accept that their code contributions are provided under Apache 2.0 but may also be offered under the Commercial License by the project. Governance artifacts or documentation are submitted under the respective content/docs licenses. High-risk contributions affecting models or tools require explicit human approval and change records.
Sources: legal/CONTRIBUTOR-AGREEMENT.md:4-16
Governance & Risk Management
The system implements a "Native Governance" framework where legal and security rules are coded into the runtime. This is not a patch but a core architectural layer.
AI Risk Register
The risk management system classifies threats from LOW to CRITICAL or PROHIBITED. Residual risk levels do not decrease without valid evidence.
Sources: governance/README.md:9-12
Human Oversight (H0-H4)
Isabella enforces specific levels of human intervention based on the impact of the action.
- H0 (Automation): Low impact, e.g., generating summaries.
- H1 (Review): Ex-post sampling for moderation.
- H2 (Approval): Human approval required for policy deployment.
- H3 (Double Approval): Two independent approvals for critical production deploys.
- H4 (Exclusive Human): Decisions like payouts or liquidations must be human-led.
Sources: governance/README.md:13-14, governance/system-cards/isabella-5-3-0.md:34-40
The diagram shows the logic for routing requests based on risk levels and human oversight requirements.
Sources: governance/README.md:13-20, governance/system-cards/isabella-5-3-0.md:34-40
Security Operations
Security is enforced via ARGUS Sentinel and the C.R.O.W.N. Policy Engine. These components implement a Zero-Trust architecture where no tool executes without prior validation.
Acceptable Use Policy (AUP)
Prohibited activities include:
- Bypassing territorial data boundaries or exfiltrating data.
- Using mock data for billing or security decisions.
- Prompt injection or technical interference.
- Generating discriminatory content or non-consensual sexual content.
Sources: legal/ACCEPTABLE-USE-POLICY.md:7-18
Security Disclosure
Vulnerabilities must be reported privately to security@tamv.online. The project maintains a response timeline including a 48-hour acknowledgement and 5-day triage period.
Sources: SECURITY.md:7-22
Technical Security Controls
The isabella_core_policy_v3.schema.json defines strict technical requirements for the system:
allowNetworkByDefault: falseallowToolsByDefault: falsefailClosed: truerequireIdempotencyKey: trueimmutableEventHash: true (sha256 or sha3_512)
Sources: scripts/policy/isabella_core_policy_v3.schema.json:69-106, scripts/policy/isabella_core_policy_v3.schema.json:159-178
Authorization Runtime (PDP)
Isabella uses a Policy Decision Point (PDP) sidecar for centralized authorization. The system defaults to a fail-closed state if the PDP is unavailable.
Role & Scope Hierarchy
Authorization is the intersection of identity, tenant, scope, role, and assurance level.
| Role | Rank | Description |
|---|---|---|
| citizen | 1 | End user. Read access to own tenant data. |
| agent | 2 | Automated agent with scoped write access. |
| operator | 3 | System operator. Manages tools and quantum jobs. |
| admin | 4 | Administrative access. No policy/secret management. |
| governance_admin | 5 | Policy authority. Requires hardware step-up. |
| system | 6 | Automated system. May use wildcard scopes. |
Sources: scripts/authz/isabella_scopes_catalog_v2.json:30-37
Assurance Levels
- Local (1): Standard JWT. Used for read operations.
- mTLS (2): Client certificates. Required for cross-service and medium-risk ops.
- Hardware-backed (3): WebAuthn/HSM/TEE attestation. Required for kill-switch and policy changes.
Sources: scripts/authz/isabella_scopes_catalog_v2.json:20-28
This sequence illustrates the externalized authorization flow using the PDP sidecar.
Sources: server.ts:251-260, scripts/authz/isabella_scopes_catalog_v2.json:10-18
Compliance & Documentation
The project maintains various compliance documents to ensure transparency and legal adherence.
- DPA.md: Data Processing Agreement.
- PRIVACY-NOTICE.md: Privacy notice and GDPR legal basis.
- AI-TRANSPARENCY-NOTICE.md: Disclaimer stating AI output may contain errors.
- THIRD-PARTY-NOTICES.md: Attribution for dependencies like React 19, Stripe SDK, and models.
Sources: legal/README.md:20-31, legal/THIRD-PARTY-NOTICES.md:7-15
Security Policies & Legal Agreements in Isabella are not merely text but active code components. The combination of quadruple licensing, Zero-Trust runtime enforcement, and multi-tier human oversight ensures that the project remains a secure and sovereign territorial infrastructure.