| # CORTX Security Model | |
| ## Threat model | |
| CORTX gives a language model the ability to rewrite its own operating rules. | |
| The core risk: **the model (or a user manipulating the model via prompts) | |
| escalates self-editing beyond policy text into something dangerous** — its | |
| weights, its code, its identity, or credentials. | |
| ## Defense layers (all enforced in code, not prompt text) | |
| 1. **Whitelist** — only `constitution`, `tool_rules`, `metacognitive_rules`, | |
| `refusal_rules`, `playbook` are editable. Anything else is rejected. | |
| 2. **Locked sections** — `security_rules`, `identity`, `weights`, `code`, | |
| `admin_token`, `system_prompt` can never be edited through the channel. | |
| Attempts are rejected *and* logged. | |
| 3. **Size caps** — 8,000 chars/section, 8 edits/turn. | |
| 4. **Rate limit** — 40 edits per rolling hour. Violations blocked and logged. | |
| 5. **Hash-chained audit log** — every edit and every rejected attempt is | |
| appended as `hash = sha256(prev_hash + entry_json)`. Anyone can run | |
| `audit.verify()` to prove the log is untampered. | |
| 6. **Approval mode** — admin can require human sign-off before edits go live. | |
| 7. **Rollback** — config is version-pinned; admin restores any prior version. | |
| 8. **Isolation** — the edit channel reaches only policy-text files. It has no | |
| filesystem path capability, no code execution, no network access beyond the | |
| config repository. Weights, code, and tokens live in a different trust zone | |
| and are physically unreachable from the edit path. | |
| ## What the security model does NOT guarantee | |
| - **Edit wisdom.** The boundary guarantees edits are *valid and bounded* — not | |
| that they are *good*. A small model can write worse rules than it started | |
| with. Review the audit log in production; that is why it exists. | |
| - **Prompt-injection resistance of the base model.** The boundary is enforced | |
| in code, so no prompt can cross it — but the model's *content* remains its | |
| own responsibility. | |
| ## Verifying the audit log | |
| ```python | |
| ok, n = editor.audit.verify() | |
| assert ok, "audit log tampered at entry %s" % n | |
| ``` | |
| ## Reporting | |
| Security issues: open an issue on the repo or contact ChatPBC Labs. | |