CAPABILITY IS NOT AUTHORIZATION.

Technical ability, repository access, model output, automation permission, dependency status, administrator status, or execution capability does not grant authority to perform protected actions.

Do not commit or publish passwords, API keys, private keys, access tokens, authentication cookies, sensitive device data, confidential evidence, privileged legal material, or security information whose disclosure would create unnecessary risk.

Installation, deployment, merge, external messaging, credential use, account changes, destructive operations, purchasing, protected-system modification, publication, or authority expansion requires the applicable explicit approval from Adrien D. Thomas.

Repair behavior must remain evidence-based, auditable, reversible, and unable to expand its own authority.

Unknown or suspicious drift should be quarantined or escalated rather than silently trusted.

External providers, models, SDKs, libraries, platforms, hosts, and services are not internal governance authorities.

Their security, provenance, licence, and permission boundaries must remain explicit.

Do not place secrets or exploitable sensitive details in public issues.

Security findings should preserve evidence and be reviewed before public disclosure or operational change.

This policy is an engineering governance document and is not a guarantee that the software is free from vulnerabilities.