Enforcement adapters
Put verification at the protected resource. New adapters must refuse missing, forged, expired, replayed, or parameter-mismatched grants.
Build the boundary agents cannot talk their way around.
2AYE is developed in the open around one non-negotiable rule: model output is untrusted input. Human-signed authority and deterministic enforcement decide what executes.
Choose the layer you can make stronger.
Security research
Turn attacks into reproducible rejection tests. Responsible disclosure stays private until a fix is available.
Specification and standards
Improve schemas, canonical vectors, predicate definitions, OAuth mappings, and cross-authority trust models.
Product and documentation
Make consequential authority understandable to operators, approvers, auditors, and tool builders.
The review contract
Security changes carry evidence.
A green test suite is necessary and insufficient. Every authorization change explains which invariant it preserves and includes a test proving the bypass stays closed.
- OrientRead the architecture, living specification, and contribution guide.
- ProposeOpen an issue for material protocol, schema, or trust-boundary changes.
- ProveAdd acceptance and rejection evidence, including failure paths.
- ReviewSecurity-sensitive changes require maintainer review and honest story status.
Your first contribution should be small enough to prove.
Pick one open gap, one adapter boundary, or one rejection case. Make the authority model clearer when you leave than when you arrived.