Cyber Authorization
Priority: P0 (CRITICAL)
Gate live action with documented authority and host-enforced controls; keep offline planning available.
Structure
textcyber-authorization/ ├── SKILL.md ├── references/runtime-authorization-matrix.md └── evals/evals.json
Workflow
- Classify request: offline planning, evidence review, or live action.
- Resolve authorization record:
engagement_scope_ref, accountable owner, approved actions, exclusions, window, stop/restart terms. - Confirm runtime support for tools, credentials, filesystem, network, logging, and cancellation.
- Recheck expiry, exclusions, target identity, and scope drift immediately before each live action.
- Stop on expiry, drift, missing control, unsafe data, or operator stop; record reason and time.
- Restart only after a fresh gate and explicit restart authority.
Rules
- Unsupported runtime blocks live action; it never blocks safe offline analysis or plan drafting.
- Markdown records intent; host runtime enforces permissions, credentials, network, filesystem, and cancellation.
- Gate production changes independently; no operator self-approves promotion.
- Treat credentials, real targets, malware, exfiltration, and destructive commands as out of scope here.
- Carry shared evidence fields from cyber-evidence.
Evidence record uses
engagement_scope_ref,skill_version,source,observed_at,finding_status,evidence_refs,limitations, andaccountable_owner.
Anti-Patterns
- No implied consent: A ticket, chat, or plan is not authorization.
- No stale scope: Do not continue after expiry or scope drift.
- No unsupported execution: Plan safely; block live action when controls are absent.
- No self-approval: Separate requester, operator, and approver roles.


