{
  "schema": "vedokrok.public-item.v1",
  "release_id": "MHC-RPUB-20260920-75ad787a",
  "url": "/knowledge/draw-the-coding-agent-s-execution-surface-before-granting-autonomy",
  "id": "MHC-D-RESEARCH-0651",
  "version": "0.1.0",
  "title": "Draw the coding agent's execution surface before granting autonomy",
  "summary": "The risk boundary is the set of things the agent can cause, not the chat window.",
  "kind": "checklist",
  "body": "List repository write access, shell commands, network egress, package installation, MCP/tools, CI triggers, secrets and deployment paths. Mark which actions are read-only, reversible, privileged or externally visible. Use the map to remove capability the task does not need.",
  "limits": [
    "The map becomes stale when tools, workflows or agent products change; repeat it after material configuration changes."
  ],
  "topics": [
    "union-ai-assisted-coding-safeguards"
  ],
  "intents": [],
  "source_ids": [
    "RS-F8FE84C698B3B53A",
    "RS-26F11AEA8D93DB43"
  ],
  "evidence": [
    {
      "claim": "NIST SSDF recommends integrating secure development practices into the software lifecycle rather than treating security as a separate late-stage review.",
      "source_id": "RS-F8FE84C698B3B53A",
      "role": "supports",
      "note": "The framework is high-level and must be tailored to the organization's development model and risk.",
      "locator": "SSDF overview"
    },
    {
      "claim": "NIST SP 800-218A adds AI-specific practices and considerations to the existing SSDF, reinforcing that AI-enabled development inherits ordinary software-security obligations plus additional AI risks.",
      "source_id": "RS-26F11AEA8D93DB43",
      "role": "supports",
      "note": "SP 800-218A targets producers and acquirers of AI models and systems broadly; coding-assistant controls here are a narrower adaptation.",
      "locator": "Abstract and introduction"
    }
  ],
  "use_when": [
    "A coding agent can edit code, run commands or call tools, but nobody has mapped what that actually reaches."
  ],
  "avoid_when": [
    "The map becomes stale when tools, workflows or agent products change; repeat it after material configuration changes."
  ],
  "example": "A docs task reveals the agent also has package-install and workflow-write capability, so those permissions are removed for the task.",
  "check": "You can name the highest-impact action the agent could currently take and why it needs that access.",
  "checklist": [
    "Repository write scope known.",
    "Shell/runtime capability known.",
    "Network path known.",
    "Tools/MCP known.",
    "Secrets and CI exposure known.",
    "Deployment or production path known."
  ],
  "sources": [
    {
      "id": "RS-F8FE84C698B3B53A",
      "title": "Secure Software Development Framework (SSDF) Version 1.1",
      "url": "https://csrc.nist.gov/pubs/sp/800/218/final"
    },
    {
      "id": "RS-26F11AEA8D93DB43",
      "title": "Secure Software Development Practices for Generative AI and Dual-Use Foundation Models: An SSDF Community Profile",
      "url": "https://csrc.nist.gov/pubs/sp/800/218/a/final"
    }
  ],
  "relations": [
    {
      "from": "MHC-D-RESEARCH-0651",
      "to": "MHC-D-RESEARCH-0308",
      "type": "useful_with",
      "url": "/knowledge/give-the-agent-only-the-tools-this-job-needs"
    }
  ],
  "collections": [
    {
      "id": "RC-E25DB1788236EF13",
      "title": "Let coding agents move fast inside a reviewable security boundary",
      "url": "/collections/let-coding-agents-move-fast-inside-a-reviewable-security-boundary"
    }
  ]
}