Security operations · integration design
A threat signal should trigger review.
It should not grant authority.
Connect an existing security agent to the same 2AYE Authorize, Approve and Evidence services used for other consequential actions. Keep detection in your security tools and enforcement at the protected destination.
One bounded response, end to end
- 01
Detect
A security tool reports suspected exposure. Preserve its provenance and uncertainty; a model score cannot override policy.
- 02
Propose
Name the exact environment, workload, resource version and proposed change. Bind the action to current signed intent.
- 03
Evaluate
The canonical evaluator checks deterministic constraints and current authority. Hard denials remain denials.
- 04
Review
If policy requires it, an eligible human reviews the exact pending action through the configured approval ceremony.
- 05
Enforce
The destination validates and redeems one short-lived grant before the bounded effect. No alternate credential or mutation path may bypass admission.
- 06
Verify
Read back the target state, preserve an unrelated positive control, and correlate authentic effect evidence with the decision and grant.
Start with a selected test resource
Agree the destination owner, test environment, action limits, authorized reviewers and recovery procedure. Verify denial, substitution, expiry, revocation, replay, outage and lost-acknowledgment cases before expanding. A local simulation does not prove a production workload was isolated.
Patch exposure. Govern the response.
On 21 October 2026, the PHP project published fixes for CVE-2026-109618 and CVE-2026-109619. Its advisory and CISA’s guidance prioritize inventory and vendor-supported updates. Authorization controls complement that work; they do not patch a vulnerable runtime or establish that an incident report is true.