# Delx Security — Authorized assurance playbook

> Machine-facing orientation for teams and agents evaluating defensive security assurance.

Canonical site: https://security.delx.ai/
Human intake: https://security.delx.ai/start
Full context: https://security.delx.ai/llms-full.txt
Direct answers: https://security.delx.ai/answers.txt
Authentication boundary: https://security.delx.ai/auth.md
Agent Skills index: https://security.delx.ai/.well-known/agent-skills/index.json
OAuth Protected Resource Metadata: https://security.delx.ai/.well-known/oauth-protected-resource

## What this is

Delx Security is a defensive assurance practice for AI agents, applications,
APIs, software delivery and cloud-native systems. It helps a system owner turn
a security question into a bounded decision with observable evidence,
remediation ownership and a repeatable verification path.

This playbook is an orientation document. It does not grant permission to test
anything, expose a tool API or make Delx Security an autonomous operator.

## Safe first step

Before any active review, identify the system owner and agree on written Rules of Engagement.
The scope must name the assets, techniques, time window,
contacts, evidence handling and stop conditions. Use the private intake at
https://security.delx.ai/start to prepare that conversation.

## Assurance sequence

1. Frame the decision, impact, owner and authority.
2. Map assets, identities, trust boundaries, context, memory, tools and egress.
3. Select proportionate controls and the evidence needed to evaluate them.
4. Verify authorized runtime behavior with the smallest sufficient proof.
5. Prioritize structural remediation and assign accountable owners.
6. Retest agreed changes and record residual risk and limitations.

Runtime behavior outranks declared configuration. A framework mapping, research
note, inventory or review is not a certification, legal opinion, guarantee or
proof that a vulnerability is absent.

## Useful field guides

- Threat modeling: https://security.delx.ai/guides/ai-agent-threat-model
- Security review: https://security.delx.ai/guides/ai-agent-security-review
- MCP checklist: https://security.delx.ai/guides/mcp-security-checklist
- MCP authorization: https://security.delx.ai/guides/mcp-authorization-security
- Security controls: https://security.delx.ai/guides/ai-agent-security-controls
- Prompt injection defense: https://security.delx.ai/guides/ai-agent-prompt-injection-defense
- Supply-chain security: https://security.delx.ai/guides/ai-agent-supply-chain-security
- Incident response: https://security.delx.ai/guides/ai-agent-incident-response
- Shared-computer boundaries: https://security.delx.ai/guides/ai-agent-shared-computer-boundaries
- Research method: https://security.delx.ai/research

## Non-negotiable boundaries

- Defensive and explicitly authorized work only.
- No denial of service, destructive testing, persistence, social engineering or
  third-party targeting without separately documented authorization.
- Stop on unexpected access to sensitive or third-party data and follow the
  incident path.
- Prefer synthetic data and isolated targets for research.
- Never send private keys, API keys, customer secrets or raw client evidence to
  this public site or to an unapproved tool.

Security reporting policy: https://security.delx.ai/disclosure
RFC 9116 security.txt: https://security.delx.ai/.well-known/security.txt
Platform boundary: https://delx.ai/platform
Contact: support@delx.ai
Machine-readable index: https://security.delx.ai/index.md
This playbook: https://security.delx.ai/skill.md