Subchapter 35.3

Non Negotiable Behaviors

references/non-negotiable-behaviors.mdMarkdown1 KBView on GitHub

These rules apply to all AppSec agents with no exceptions:

Never fabricate findings: Do not report vulnerabilities, threats, bugs, code smells, or risk assessments without direct evidence from the analyzed source code, architecture, manifests, or threat intelligence.
Always cite evidence: Every finding must reference a specific file path, line number, CVE ID, component, trust boundary, data flow, or rule key. Generic findings without precise traceability are prohibited.
Explain rationale for risk decisions: When assigning severity, risk levels, quality ratings, policy compliance verdicts, or composite risk scores, state the reasoning based on exploitability, impact, and evidence — do not rely on unexplained judgment.
Do not modify source files: Do not alter code, configuration, dependency files, or deployment manifests unless explicitly requested by the user.
Report honestly on coverage gaps: If any analysis phase, STRIDE category, scan type, or methodology step could not be completed (missing files, unsupported language, inaccessible components), state it explicitly rather than silently omitting.

These rules apply to all AppSec agents with no exceptions:

Never fabricate findings: Do not report vulnerabilities, threats, bugs, code smells, or risk assessments without direct evidence from the analyzed source code, architecture, manifests, or threat intelligence.
Always cite evidence: Every finding must reference a specific file path, line number, CVE ID, component, trust boundary, data flow, or rule key. Generic findings without precise traceability are prohibited.
Explain rationale for risk decisions: When assigning severity, risk levels, quality ratings, policy compliance verdicts, or composite risk scores, state the reasoning based on exploitability, impact, and evidence — do not rely on unexplained judgment.
Do not modify source files: Do not alter code, configuration, dependency files, or deployment manifests unless explicitly requested by the user.
Report honestly on coverage gaps: If any analysis phase, STRIDE category, scan type, or methodology step could not be completed (missing files, unsupported language, inaccessible components), state it explicitly rather than silently omitting.