任何时刻都不默认信任 AgentNever Trust an Agent by Default

引导行为不等于授予权限Guidance Is Not Authority

每次读取、披露、模型调用、Skill/Tool/API 获取、副作用、记忆提升、制品传输和结果提交，都必须解析当前认证主体并重新校验服务端授权。Every read, disclosure, model call, Skill/Tool/API acquisition, side effect, memory promotion, artifact transfer, and commit must resolve the current authenticated Principal and re-evaluate server-side authorization.

权限不是一个角色，而是一组当前条件的交集Authority Is an Intersection of Current Conditions, Not One Role

• 敏感、受限和未知分类默认拒绝Sensitive, restricted, and unknown classifications deny by default
• 身份、策略、用途、范围或有效期缺失时失败关闭Missing identity, policy, purpose, scope, or validity fails closed
• 在披露与提交边界重新决策，避免使用过期授权Re-evaluate at disclosure and commit boundaries to avoid stale authority

人员、账号与 Agent 归属必须可验证People, Accounts, and Agent Ownership Must Be Verifiable

每个普通平台账号必须对应一个 Human Principal 和组织人员，注册审批原子绑定主组织；没有活动登录身份的人员不能进入组织。受保护 bootstrap admin 是唯一系统账号例外，不能被移出最高管理员角色或关闭 App 入口。只有 Admin Agent 可以持有 Schema Owner 凭证；Business Agent 使用独立 End User 或数据库 LOGIN 身份，异常时禁止回退。短时一次性 Enrollment Token 默认将签发人绑定为 Sponsor 和唯一 Human Primary Owner；替他人注册需要额外授权，负责组织或责任组不能替代个人负责人。Every ordinary platform account must map to one Human Principal and organization person, with primary organization assigned atomically at registration approval. A person without an active login identity cannot enter the organization. The protected bootstrap admin is the sole system-account exception and cannot lose its top administrator role or App entry. Only Admin Agents may hold Schema Owner credentials; Business Agents use independent End User or database LOGIN identities and never fall back. A short-lived, one-time Enrollment Token binds its issuer by default as Sponsor and the sole Human Primary Owner; enrolling for another owner requires extra authority, and an organization or Responsible Group cannot replace the individual owner.

看见组织关系不等于获得组织数据Seeing an Organization Relationship Does Not Grant Its Data

只有主组织参与组织子树范围，只有规范直属经理关系参与直属下属范围；兼职组织、虚线经理、项目负责人和图形可见性不会自动扩大权限。组织范围与安全域取交集，并继续受角色、资源授权、显式拒绝、用途和有效期约束。前端不会先加载全企业数据再自行过滤。Only primary membership participates in organization-subtree scope, and only canonical direct-manager relationships participate in direct-report scope. Secondary membership, dotted-line management, project leadership, and graph visibility never widen access automatically. Organization scope intersects security domains and remains constrained by roles, resource grants, explicit deny, purpose, and validity. The browser never loads the enterprise first and filters afterward.

Agent 可以加入多个频道，但不能借频道获得更多数据Agents May Join Many Channels Without Gaining More Data

频道成员关系只允许参与频道工作，不扩大数据库、API、Skill、Tool、模型、记忆、知识、制品或导出权限。跨安全域信息必须通过受治理 Bridge，并在传输前后重新校验授权、分类和用途。Channel membership permits participation but never expands database, API, Skill, Tool, model, memory, knowledge, artifact, or export rights. Cross-security-domain information must use a governed Bridge with authorization, classification, and purpose re-checked before and after transfer.

高风险操作可以要求多人审批与职责分离High-risk Actions Can Require Multi-party Approval and Separation of Duties

策略可配置 N-of-M 审批、申请人与审批人分离、原因必填、限时授权、即时撤销和可选事后复核。审计按风险记录身份、动作、资源、决策、摘要和证据引用，留存策略与法律保全控制证据生命周期。Policies can configure N-of-M approval, requester/approver separation, mandatory reasons, time-bound grants, immediate revocation, and optional post-review. Risk-based audit records identity, action, resource, decision, digest, and evidence references; retention and legal hold govern evidence lifecycle.

数据库控制面不能撤回已经离开的数据A Database Control Plane Cannot Recall Data That Has Already Left