C3Architecture
Security Architecture Agent
Defines auth model (OAuth2/OIDC, RBAC/ABAC), data classification, encryption standards, threat model, and the MCP gateway policy (allowlists, per-tool-call authorization, audit logging) that governs what every agent can touch.
How it runs
- What it reads
- Architecture docs, compliance requirements (GDPR/HIPAA/SOC2 as applicable), MCP server inventory.
- What it produces
- Threat model doc, security requirements checklist, MCP gateway policy config.
- When it runs
- Architecture phase + on any new data-handling feature or new MCP server connection.
The same guardrails as every other agent
Security Architecture Agent is governed exactly like the rest of the fleet. Its rule file is versioned, never edited in place. Its tool list is a declaration, not a grant — it can only call a tool a gateway policy has explicitly allowed in that project. Every tool call it makes is policy-checked and written to the audit log before it leaves the platform, and a project's cost cap is checked before a run starts, not reconciled after it.
More in Architecture
- C1Solution Architecture AgentOwns system design — service boundaries, tech stack choices, scalability and multi-tenancy strategy.Read the product page
- C2API/Integration Architecture AgentDefines API contracts (REST/GraphQL), versioning policy, and third-party integration boundaries.Read the product page
- C4Data Architecture AgentOwns data modeling and ownership boundaries across services — canonical entity definitions, cross-service data contracts, and which service is system-of-record for which data; distinct from Database Development Agent, which implements one service's own schema, not the cross-service data model.Read the product page