OpenFGA Graph Invariants: Cyclic Relation Prevention & Contextual Tuple Hardening
Enforces strict directed acyclic graph (DAG) topology validation during relationship mutation writes and mandates strict server-side schema verification for ephemeral contextual tuples in OpenFGA evaluations. Prohibits persistent storage of ephemeral request attributes and guards against recursive relation loops causing graph expansion denial-of-service.
WebAuthn Conditional UI Mediation, Nonce Atomicity, and Assertion Cryptographic Verification
Enforces zero-trust cryptographic validation for FIDO2/WebAuthn Passkey authentication with Conditional UI autofill. Requires atomic single-use challenge consumption to eliminate replay attacks, strict RP ID hash and origin binding, authenticatorData flag verification (User Presence and User Verification), and monotonic signature counter enforcement to detect authenticator cloning.
Enforce Sigstore Keyless OIDC Attestation and Admission Controller Verification
Enforces immutable supply-chain security using Sigstore Cosign keyless signing via ephemeral OIDC tokens issued by Fulcio and verified against the Rekor transparency log. Container workloads must be signed and attested at build time by digest, and admission controllers (such as Kyverno or Sigstore Policy Controller) must strictly validate the OIDC issuer and subject identity before allowing image execution.
HashiCorp Vault Ephemeral Database Credentials and Lease-Aware Connection Pool Lifecycle
Production services interacting with relational datastores must consume short-lived ephemeral credentials issued dynamically by HashiCorp Vault with zero persistent root or shared credentials in configuration. Application connection pools must actively monitor lease TTLs, schedule proactive renewals before expiry, and gracefully drain and refresh database connection pools upon credential rotation without service downtime.
OWASP LLM-01 Indirect Prompt Injection Sandboxing, Delimiter Escaping & Deterministic Intent Verification
Untrusted text from RAG retrievals, web scrapers, and external APIs must be treated as untrusted user payload rather than prompt instructions. Applications must enforce rigorous XML tag sanitization, strict isolation within defined data boundaries, and secondary schema-driven deterministic verification before triggering downstream tool executions or state changes.
SPIFFE/SPIRE Zero-Trust Workload Identity Attestation and Hot-Reloading
Enforces strict validation, dynamic in-memory hot-reloading, and trust-bundle verification for SPIFFE X.509 SVIDs over short-lived mTLS connections. Prevents static certificate caching, filesystem secret leakage, and permissive Subject Alternative Name (SAN) validation in microservice workloads.
OAuth 2.1 DPoP Proof Validation, Nonce Enforcement, and Token Binding Verification
Mandates strict RFC 9449 compliance for DPoP (Demonstrating Proof-of-Possession) verification across Authorization Servers and Resource Servers. Enforces asymmetric key thumbprint matching (jkt/cnf), cryptographic validation of DPoP proof headers and claims (typ, htm, htu, ath, nonce), and distributed jti cache tracking to prevent replay attacks within clock skew bounds.
Kernel-Level Tetragon eBPF Telemetry and Privilege Boundary Enforcement
Enforce real-time kernel-space tracing and synchronous threat remediation using Cilium Tetragon TracingPolicies across Kubernetes workloads. Guardrails mandate in-kernel filtering for execution, namespace boundary crossing (setns/unshare), and capability acquisition to eliminate TOCTOU race conditions and user-space ring buffer flooding.
Strict ES256 Asymmetric Key Verification, JWKS Cache Invalidation, and Distributed Token Revocation
Enforces immutable cryptographic pinning to ECDSA P-256 (ES256) signature validation with robust JWKS key caching and rate-limiting. Mandates explicit verification of standard claims (iss, aud, exp, nbf) and enforces an atomic distributed blacklist lookup using a unique jti against a shared key-value store to support instantaneous token revocation.
Strict CSP L3 Nonce Injection, Strict-Dynamic, and Trusted Types Enforcement
Enforces dynamic, cryptographically secure per-request nonce generation for Content Security Policy Level 3 compliance across all SSR/edge layers. Mandates the elimination of 'unsafe-inline' and 'unsafe-eval' via 'strict-dynamic' and prevents client-side DOM-XSS sinks by enforcing Trusted Types policies.
SLSA Level 3 Cryptographic Provenance, CycloneDX SBOM Generation, and Dependency Quarantine
Enforces non-falsifiable SLSA Level 3 cryptographic build provenance and machine-readable CycloneDX Software Bill of Materials (SBOM) generation across all build and release pipelines. Mandates pre-deployment quarantine validation gates that verify in-toto/Cosign attestations, evaluate component hashes against official registries, and block unverified artifacts from execution environments.
Kubernetes Gateway API v1 HTTPRoute Canary and ReferenceGrant Invariants
Enforces strict conformance to Kubernetes Gateway API v1 specifications during migration from legacy Ingress controllers. Mandates explicit ReferenceGrant resources for cross-namespace routing, strict relative integer weighting for HTTPRoute canary releases, and explicit backendRef port declarations.
ArgoCD ApplicationSet Matrix Generator Invariants & Cascade Deletion Guards
Enforces strict structural constraints on ArgoCD ApplicationSet Matrix generators combining cluster selectors and Git directories. Prevents catastrophic multi-cluster cascade pruning, accidental secret exposure through parameter interpolation, and runaway Application CR explosion via explicit sync policies, preservation finalizers, and parameter validation.
Karpenter Resilient Topology, Interruption Queue, and Consolidation Budget Standard
Enforces deterministic disruption budgets, multi-instance-type diversification, and event-driven SQS interruption queue handling across Karpenter NodePools and EC2NodeClasses. Eliminates cascading eviction loops, instance starvation, and availability downtime during AWS Spot rebalances and underutilized node consolidation.
OpenTelemetry Collector Processor Pipeline Order and Memory Guardrails
Mandates strict ordering and configuration of OpenTelemetry Collector processor pipelines. Enforces memory_limiter as the non-negotiable first processor to prevent process crashes, requires OTTL-driven PII redaction before persistence or sampling, and mandates dedicated pipeline tiers for tail-based sampling.
Caddy 2 Hardened On-Demand TLS with Ask Endpoint Validation and HTTP/3 Proxying
Enforces secure On-Demand TLS configuration in Caddy 2 by mandating an authenticated internal 'ask' endpoint and edge rate limiting. Prevents Let's Encrypt Certificate Authority rate-limit exhaustion, disk exhaustion, and denial-of-service attacks driven by arbitrary SNI spoofing. Ensures proper HTTP/3 reverse proxy configuration with UDP 443 exposure and downstream connection sanitization.
Cilium eBPF Mesh, WireGuard Transparent Encryption, and Hubble L7 Observability
Enforces a sidecar-free service mesh architecture utilizing kernel-level eBPF socket programs, strict pod-to-pod WireGuard encapsulation, and granular L7 Hubble observability. Prevents legacy iptables/kube-proxy bottlenecks, sidecar resource tax, MTU mismatch packet drops, and unencrypted cross-node data plane transit.
Deterministic Crossplane Compositions & Controlled Reconciliation Invariants
Enforces strict determinism, declarative immutability, and state reconciliation invariants within Crossplane CompositeResourceDefinitions (XRDs) and Compositions. Mandates the use of explicit connection secret distribution, pipeline composition functions (v1beta1 Composition Functions) over legacy patch-and-transform engines, and explicit deletion policies to prevent resource orphan loops and drift.
Multi-Architecture Buildx Cache Partitioning and Bake Orchestration
Multi-platform Docker builds must partition BuildKit cache mounts and GitHub Actions GHA backend cache scopes by target architecture (TARGETARCH). Unpartitioned cache mounts across amd64 and arm64 result in cross-architecture binary poisoning, ABI corruption, and severe cache thrashing in CI pipelines.
Terraform 1.10 Ephemeral Variables, Plan Protection, and AWS KMS Native State Encryption
Enforces Terraform 1.10+ native state encryption and ephemeral value handling across all infrastructure code. Eliminates plain-text secret persistence in state files and plan artifacts by binding ephemeral variables directly to supported provider arguments and securing root-level state with native AWS KMS encryption blocks.
Prometheus 3.0 Native Histograms and OTel Ingest Guardrails
Enforces Prometheus 3.0 sparse-bucket native histograms and OpenTelemetry ingestion standards. Mandates Prometheus Remote Write 2.0 streaming with memory-efficient deduplication to eliminate exponential time-series cardinality explosions and telemetry transport overhead.
Mandatory WebAuthn L3 Conditional Mediation & Passkey Lifecycle Invariants
Enforces W3C WebAuthn Level 3 conditional mediation ('conditional UI') across all public entry points to eliminate credential stuffing and adversary-in-the-middle phishing. Mandates cryptographically binding server-side challenge-response validation, strict RP ID origin scoping, AbortController lifecycle management for autofill requests, and inspection of backup eligibility and state flags (BE/BS) for synchronized passkeys.
Enforce In-Kernel Real-Time Exploit Prevention and Process Termination with Cilium Tetragon
Cilium Tetragon TracingPolicies must execute synchronous in-kernel enforcement (such as Sigkill) directly inside eBPF hook handlers rather than relying on asynchronous userspace alerting. Real-time prevention stops memory corruption exploits, container escapes, and unauthorized binary executions before payload completion, eliminating the Time-of-Check to Time-of-Use (TOCTOU) vulnerability window inherent in passive monitoring.
OpenFGA Real-Time ReBAC Tuple Evaluation & Invalidation Caching Standard
Enforces sub-millisecond fine-grained authorization evaluations while preventing stale permissions and TOCTOU vulnerabilities. Combines event-driven distributed cache invalidation via change-data-capture (CDC) or transactional outbox with OpenFGA contextual tuples for dynamic request attributes.
Codex / Cline Native Configuration Format
Target location: ./AGENTS.md
# AgentRules: Universal AGENTS.md Autonomous Specification ## Safe Execution Rules - Never issue destructive filesystem commands across shells without path checks. - Do not mark tasks complete without running real build and test validations. - Respect user changes in dirty worktrees; never revert without explicit user consent. ## Engineering Judgment - Prefer existing codebase patterns over inventing new architectural layers. - Keep edits scoped strictly to the module implied by the prompt.
Top AI Hallucination Traps Solved for Codex / Cline
Without deterministic negative constraints, AI coding models frequently fall into common architectural failure modes:
Frequently Asked Questions: Codex & Cline Autonomous Agents (AGENTS.md)
Common questions about configuring rules, optimizing context token usage, and enforcing architectural invariants in Codex / Cline.