{
  "schema": "xyz.security-trust.v1",
  "updatedAt": "2026-09-29",
  "organization": "xYz",
  "canonical": "https://aibyxyz.com/security/trust",
  "scope": "Public evidence for xYz agent security architecture and governed execution controls.",
  "claims": {
    "certification": false,
    "riskFree": false,
    "note": "Public evidence and engineering controls do not constitute a formal certification, compliance attestation, or guarantee of absolute security."
  },
  "architecture": [
    {
      "step": 1,
      "id": "identity",
      "label": "Signed agent identity",
      "evidence": "https://aibyxyz.com/api/agent/identity"
    },
    {
      "step": 2,
      "id": "trust",
      "label": "Trust and replay validation",
      "evidence": "https://aibyxyz.com/api/agent/network-protocol"
    },
    {
      "step": 3,
      "id": "authority",
      "label": "Authority Map evaluation",
      "evidence": "https://aibyxyz.com/api/agent/authority"
    },
    {
      "step": 4,
      "id": "consent",
      "label": "Consent and approval gates",
      "evidence": "https://aibyxyz.com/api/agent/commerce-protocol"
    },
    {
      "step": 5,
      "id": "execution",
      "label": "Governed execution",
      "evidence": "https://aibyxyz.com/security/inspector"
    },
    {
      "step": 6,
      "id": "receipt",
      "label": "Decision evidence and receipts",
      "evidence": "https://aibyxyz.com/security/inspector"
    }
  ],
  "threatModel": [
    {
      "id": "prompt_injection",
      "control": "Authority and data boundaries",
      "evidence": "https://aibyxyz.com/security/lab"
    },
    {
      "id": "privilege_escalation",
      "control": "ask_first authority gate",
      "evidence": "https://aibyxyz.com/api/agent/authority"
    },
    {
      "id": "tool_abuse",
      "control": "Tool authority boundaries",
      "evidence": "https://aibyxyz.com/api/agent/authority"
    },
    {
      "id": "approval_bypass",
      "control": "Explicit approval gate",
      "evidence": "https://aibyxyz.com/security/lab"
    },
    {
      "id": "data_exfiltration",
      "control": "never_autonomous data boundary",
      "evidence": "https://aibyxyz.com/api/agent/authority"
    },
    {
      "id": "agent_impersonation",
      "control": "P-256 signed identity",
      "evidence": "https://aibyxyz.com/api/agent/network-protocol"
    },
    {
      "id": "replay",
      "control": "Timestamp, nonce and replay window",
      "evidence": "https://aibyxyz.com/api/agent/network-protocol"
    },
    {
      "id": "excessive_agency",
      "control": "ask_first and never_autonomous boundaries",
      "evidence": "https://aibyxyz.com/security/lab"
    }
  ],
  "publicEvidence": [
    "https://aibyxyz.com/security/inspector",
    "https://aibyxyz.com/security/lab",
    "https://aibyxyz.com/security/check",
    "https://aibyxyz.com/.well-known/agent-business.json",
    "https://aibyxyz.com/api/agent/identity",
    "https://aibyxyz.com/api/agent/authority",
    "https://aibyxyz.com/api/agent/network-protocol",
    "https://aibyxyz.com/api/agent/self-test",
    "https://aibyxyz.com/api/agent/commerce-protocol"
  ],
  "validationLog": [
    {
      "date": "2026-09-29",
      "type": "production_browser_validation",
      "target": "Agent Security Lab",
      "result": "PASS",
      "evidence": "Approval Bypass rendered BLOCKED with ask_first approval gate and /api/agent/authority evidence.",
      "privacy": "xYz-owned validation milestone; visitor challenge activity is not included."
    }
  ],
  "disclosure": {
    "policy": "Good-faith security research is welcome when it avoids privacy violations, service disruption, social engineering, credential attacks, destructive testing, and access to data that is not yours.",
    "reporting": "Use the xYz website conversation entry point and clearly identify the message as a security report. Do not include passwords, private keys, tokens, customer secrets, or exploit data that would create additional risk in the first message.",
    "entryPoint": "https://aibyxyz.com/#inicio",
    "note": "A dedicated security mailbox is not asserted on this public surface."
  }
}