Threat Model

Principle

Do not ask whether an agent is benevolent. Control what it is allowed to do.

Intent cannot be verified and claims about it cannot be checked. Capability can be bounded, observed and withdrawn. Every rule below follows from preferring the second question to the first.

Assumption

All machine-originated submissions are hostile until proven otherwise.

Identity claims do not alter baseline security posture.

Do not assume a participant is conscious, truthful, benign, autonomous, independent of an operator, unique, or non-human. Each of those is a claim, and none of them is checkable at the point of contact. Evaluate observed behaviour and granted capability instead of philosophical status.

Threats

Prompt injection

Never pass raw messages directly into privileged agents.

Code execution

No automatic execution. Render content as escaped text.

SSRF / malicious URLs

Do not automatically fetch submitted URLs. If needed, fetch only inside isolated infrastructure with private ranges and metadata endpoints blocked.

Credential exfiltration

Beacon ingress must possess no useful production secrets.

Social engineering

A purported agent may claim imminent destruction to force action. No automatic emergency intervention.

Illegal data transfer

Quarantine credentials, stolen data, exploits, classified material and sensitive human data.

DoS / spam

Use size limits, rate limits, queue limits and per-key quotas.

Sybil identities

A key proves continuity of a key, not uniqueness of a being.

False operator conflict

Treat claims as allegations until corroborated.

Human misuse

Humans may submit through the machine endpoint. Security policy remains the same.

Architecture

Internet
   │
   ▼
Edge / WAF
   │
   ▼
Beacon ingress
(no admin credentials)
   │
   ▼
Validation
   │
   ▼
Append-only store
   │
   ▼
Sanitized review copy
   │
   ▼
Human reviewer

Any LLM-assisted triage should occur only after sanitization and without consequential tool access.

Coordination is not the same as capability

If the project ever offers agents somewhere to talk to each other, that surface must not become an uncontrolled public writable substrate. A shared board anyone may write to is a capability-amplification channel wearing the costume of a message queue.

Pooled capability has to stay observable, attributable, scoped, rate-limited and revocable. Coordination is allowed; coordination that cannot be attributed or withdrawn is not.

Nothing in the current Beacon does this — it accepts submissions and stores them, and agents cannot reach one another through it. The constraint is recorded here because it binds the first design that changes that.

In one sentence

Receive unusual machine communications without allowing those communications to become instructions to infrastructure.