VIGIL — Governance
The authorization chain
Every consequential action in VIGIL passes the same chain of controls. They are conjunctive — all must pass — and fail-closed — the absence of a control is a denial, never a default allow.
Roles are cumulative, and owner is the trust root
VIGIL uses four cumulative roles. Each inherits the permissions below it and adds its own:
| Role | Adds |
|---|---|
| viewer | read state, read evidence, trip a safe stop |
| analyst | queue proposals and analysis, without launching an engagement |
| operator | run ordinary engagements, approve the operator tier, toggle guards, set non-secret config |
| owner | the trust root: owner-tier approvals, key release, promotion, secrets, offense authority, user management |
The owner role is not a bearer account that can be handed around; it corresponds to the holder of the trust root. An unknown route or permission is denied by default.
WARDEN classifies every action, fail-closed
Before an action runs, WARDEN derives a risk class from the real name of the tool or action — A0 through A3 — and constrains the level of approval required. An action it cannot classify is treated as high risk and denied, not waved through.
The admission chain
An action is admitted only if it passes, in order: authentication (a valid local principal), RBAC (the exact permission), a valid signed usage right, an authorized scope (target, time, method, environment), the WARDEN class and its required approval, and egress control. A destructive action additionally requires a multi-party quorum. Any step can end the action; none can be skipped.
Emergency stop is always available
Any authenticated principal can move in the safe direction — stop activity or trip a kill switch. Lifting a stop and restoring capability is owner-only. A revoked usage right never prevents an institution from stopping its own system.