Aurea Specification - Open Arsenal

Home / Aurea / Aurea Specification

Aurea

Golden Standards for IaC Security

Specification Overview

Aurea is a fully open-source, AI-powered Infrastructure-as-Code security specification designed to provide continuous security analysis throughout the software development and infrastructure deployment lifecycle.

Aurea analyzes infrastructure definitions, identifies vulnerabilities and misconfigurations, evaluates security and compliance policies, provides AI-assisted remediation, and integrates directly into CI/CD and GitOps workflows.

Aurea is designed as a modular security system. Core modules provide the foundational security capabilities required by the specification. Optional plugin modules extend Aurea with additional infrastructure formats, cloud providers, compliance frameworks, AI systems, integrations, reporting systems, and specialized security capabilities.

Aurea is designed around local-first operation, vendor neutrality, explainable AI, least privilege, zero-trust principles, human oversight, reproducibility, and airtight service isolation.

Design Goals

Provide open-source IaC security automation
Detect infrastructure vulnerabilities before deployment
Integrate security directly into CI/CD pipelines
Support continuous infrastructure security validation
Combine deterministic analysis with AI-assisted analysis
Provide explainable security findings
Prioritize security risks according to context and impact
Provide actionable remediation guidance
Support policy-as-code
Support compliance validation
Provide infrastructure drift detection
Support security testing across development and deployment environments
Enable controlled adversarial AI testing
Maintain strict isolation between services and AI agents
Provide enterprise governance without requiring proprietary infrastructure
Remain modular and extensible
Avoid vendor lock-in
Support local and offline security analysis where practical

Core Architecture Principles

Modular Design

Aurea consists of independently defined modules with clear interfaces and responsibilities.

Core modules provide essential Aurea functionality.

Optional plugin modules extend Aurea without requiring changes to the core security engine.

Modules should communicate through documented interfaces and should not require unnecessary coupling.

Local-First Security

Aurea should support local execution whenever practical.

Security analysis should not require sending infrastructure code, credentials, secrets, or security findings to an external service.

External services should be optional integrations rather than mandatory dependencies.

Security by Default

Aurea must default to restrictive security settings.

Unsafe functionality must require explicit authorization.

High-impact actions must require explicit policy authorization and, where configured, human approval.

Least Privilege

Every Aurea service, module, plugin, integration, and AI agent should receive only the permissions required to perform its assigned function.

Zero-Trust Architecture

Aurea services must not implicitly trust one another.

Authentication, authorization, and capability validation should occur at service boundaries.

Airtight Service Isolation

Aurea must maintain strict isolation between services, plugins, AI agents, evaluation environments, credentials, and target infrastructure.

Security boundaries must be enforced by the execution environment and policy engine rather than relying solely on AI instructions.

Core Modules

IaC Analysis Module

The IaC Analysis Module provides the foundational analysis engine for Infrastructure-as-Code.

Supported Infrastructure Formats

Terraform
Kubernetes manifests
Dockerfiles
Ansible
CloudFormation
Helm
Additional formats through plugins

Analysis Capabilities

IaC parsing
Syntax analysis
Semantic analysis
Configuration analysis
Misconfiguration detection
Insecure default detection
Excessive privilege detection
Public exposure detection
Network security analysis
Identity and access analysis
Encryption configuration analysis
Storage security analysis
Logging configuration analysis
Monitoring configuration analysis
Backup configuration analysis
Container configuration analysis
Infrastructure dependency analysis
Infrastructure attack-surface analysis
Zero-trust readiness analysis

Security Rules Module

The Security Rules Module provides deterministic security detection.

Capabilities

Built-in security rules
Custom security rules
Rule severity
Rule categories
Rule identifiers
Rule descriptions
Rule remediation guidance
Rule versioning
Rule validation
Rule testing
Rule suppression
Rule exceptions
Rule expiration
Rule inheritance
Rule conflict detection
Organization-specific rules

Secrets Security Module

The Secrets Security Module identifies potentially exposed credentials and sensitive information.

Capabilities

Hardcoded secret detection
Credential detection
API key detection
Token detection
Private key detection
Password detection
Secret pattern analysis
Secret redaction
Secret exposure reporting
Secret remediation guidance
Secret scanning in IaC
Secret scanning in configuration files

The module must prevent discovered secrets from being unnecessarily exposed in logs, reports, AI prompts, or external integrations.

Dependency and Supply Chain Module

The Dependency and Supply Chain Module evaluates dependencies associated with infrastructure.

Capabilities

IaC module analysis
Terraform module analysis
Container image analysis
Dependency vulnerability detection
Dependency version analysis
Known vulnerability correlation
Dependency provenance analysis
Supply-chain risk analysis
Dependency risk scoring
Dependency update recommendations
Malicious dependency detection where supported
Dependency policy enforcement

Risk Intelligence Module

The Risk Intelligence Module evaluates and prioritizes security findings.

Capabilities

Severity classification
Risk scoring
Business-impact scoring
Exploitability scoring
Exposure scoring
Asset criticality scoring
Composite risk scoring
Risk prioritization
Risk aggregation
Risk correlation
Risk trend analysis
Risk aging analysis
Risk heatmaps
Attack-path prioritization
Environment-aware risk scoring
Custom organizational risk models
Risk acceptance workflows

AI Security Analysis Module

The AI Security Analysis Module provides AI-assisted infrastructure security analysis.

Capabilities

AI-powered IaC analysis
Context-aware security analysis
Infrastructure architecture understanding
Cross-file reasoning
Cross-resource reasoning
Cross-language reasoning
Security intent detection
AI anomaly detection
AI threat modeling
Attack-path reasoning
Predictive risk analysis
Predictive misconfiguration analysis
False-positive reduction
AI confidence scoring
Explainable AI findings
Natural-language security queries
Natural-language infrastructure analysis
AI-generated security recommendations
AI-assisted compliance analysis
AI-assisted policy creation

AI-generated findings must remain distinguishable from deterministic security findings.

AI Agent Module

The AI Agent Module provides controlled AI agents for Aurea security workflows.

Agent Types

Security analyst agents
Code review agents
Infrastructure security agents
Red-team agents
Blue-team agents
Remediation agents
Policy agents
Compliance agents
Threat analysis agents

Agent Controls

Agent identity
Agent authentication
Agent authorization
Capability profiles
Tool permissions
File permissions
Network permissions
API permissions
Resource limits
Execution limits
Action restrictions
Target restrictions
Agent activity logging
Agent decision auditing
Agent termination controls

AI agents must not be able to grant themselves additional permissions.

Policy-as-Code Module

The Policy-as-Code Module provides centralized security policy enforcement.

Capabilities

Security policies
Compliance policies
Organization policies
Project policies
Environment policies
Policy inheritance
Policy versioning
Policy exceptions
Policy expiration
Policy testing
Policy validation
Policy conflict detection
Policy enforcement
Policy simulation
Natural-language policy generation
AI-assisted policy creation

Compliance Module

The Compliance Module maps infrastructure configurations to security and regulatory requirements.

Capabilities

CIS mapping
SOC 2 mapping
ISO 27001 mapping
HIPAA mapping
GDPR mapping
Custom compliance frameworks
Compliance scoring
Compliance coverage analysis
Compliance gap analysis
Evidence collection
Audit-ready reporting
Compliance trend analysis
Compliance policy enforcement

Remediation Module

The Remediation Module provides security remediation recommendations and controlled automated fixes.

Capabilities

Remediation recommendations
Secure configuration examples
AI-generated patches
AI-generated IaC corrections
Auto-fix suggestions
Remediation previews
Remediation validation
Post-remediation rescanning
Rollback support
Fix prioritization
Remediation tracking
Remediation history
Fix effectiveness analysis

Automatic remediation must be configurable and must support human approval for high-impact actions.

CI/CD Security Module

The CI/CD Security Module integrates Aurea directly into development pipelines.

Capabilities

Pipeline-native scanning
Pull request scanning
Merge request scanning
Commit-triggered scanning
Pre-commit scanning
Changed-file scanning
Incremental scanning
Full repository scanning
Pipeline security gates
Configurable failure thresholds
Warning-only mode
Security approval gates
Build blocking
Deployment protection
Pipeline artifacts
Security result publishing

CI/CD Platforms

GitHub Actions
GitLab CI
Jenkins
CircleCI
Bitbucket Pipelines
Generic CI/CD systems

CLI Module

The CLI Module provides local and automated command-line access.

Capabilities

Local scanning
Repository scanning
Directory scanning
File scanning
Configuration management
Policy execution
Report generation
AI queries
Finding management
Remediation workflows
Pipeline execution
Baseline management
Plugin management

Developer Security Module

The Developer Security Module provides security feedback directly within development workflows.

Capabilities

Developer-friendly findings
Inline security guidance
Pull request comments
Merge request comments
Pre-commit hooks
IDE integration
Editor diagnostics
Secure configuration examples
Remediation guidance
Finding ownership
Finding suppression
Finding expiration

Infrastructure Intelligence Module

The Infrastructure Intelligence Module creates a security-aware representation of infrastructure.

Capabilities

Infrastructure inventory
Resource discovery
Resource classification
Resource relationship mapping
Infrastructure dependency graphs
Security architecture visualization
Internet exposure mapping
Network topology analysis
IAM relationship analysis
Infrastructure attack graphs
Configuration dependency analysis
Environment comparison

Drift Detection Module

The Drift Detection Module compares declared infrastructure with deployed infrastructure.

Capabilities

IaC-to-runtime comparison
Configuration drift detection
Unauthorized change detection
Drift history
Drift classification
Drift risk scoring
Drift remediation recommendations
Runtime-to-IaC reconciliation
Continuous drift monitoring

Runtime Security Module

The Runtime Security Module provides optional continuous infrastructure security analysis.

Capabilities

Runtime configuration monitoring
Cloud event-triggered scans
Kubernetes event-triggered scans
Runtime policy validation
Configuration change tracking
Runtime anomaly detection
Runtime risk scoring
Runtime-to-IaC comparison

Cloud Security Module

The Cloud Security Module provides cloud infrastructure security analysis.

Supported Platforms

AWS
Microsoft Azure
Google Cloud
OpenStack
Hybrid environments

Capabilities

Cloud account analysis
Cloud project analysis
Cloud resource analysis
Cloud posture analysis
Cross-cloud risk analysis
Cross-cloud policy enforcement
Cloud configuration validation

Container and Kubernetes Security Module

The Container and Kubernetes Security Module provides containerized infrastructure security analysis.

Capabilities

Kubernetes security analysis
Pod security analysis
Namespace security analysis
RBAC analysis
Network policy analysis
Service exposure analysis
Ingress security analysis
Container privilege analysis
Image configuration analysis
Dockerfile analysis
Container vulnerability integration
Helm analysis
Kubernetes policy enforcement
GitOps security validation

Collaboration Module

The Collaboration Module provides team-based security workflows.

Capabilities

Finding assignment
Task management
Finding comments
Security discussions
Remediation ownership
Escalation workflows
Team dashboards
Developer dashboards
Security dashboards
Executive dashboards
Team security scorecards
Security notifications
Critical-risk alerts
Remediation reminders
Collaboration history

Enterprise Governance Module

The Enterprise Governance Module provides organization-wide security controls.

Capabilities

Role-based access control
Multi-tenant architecture
Team permissions
Project permissions
Environment permissions
Organization governance
Centralized policy management
Enterprise policy inheritance
Governance dashboards
Cross-team visibility
Cross-project visibility
Centralized finding management
Security ownership
Approval workflows
Exception management
Risk acceptance
Administrative activity logging
AI decision auditing
Remediation auditing

Reporting and Analytics Module

The Reporting and Analytics Module provides security visibility and historical analysis.

Capabilities

Security posture dashboards
Risk dashboards
Compliance dashboards
Infrastructure dashboards
Executive summaries
Developer dashboards
Historical trend analysis
Vulnerability trends
Misconfiguration trends
Compliance trends
Team performance metrics
Mean-time-to-remediation tracking
Open-risk tracking
Risk aging analysis
Custom reports
Scheduled reports
Audit evidence export

Output Formats

HTML
PDF
JSON
YAML
SARIF
CLI output

Threat Intelligence Module

The Threat Intelligence Module correlates infrastructure findings with security intelligence.

Capabilities

CVE intelligence
Security advisory integration
IaC module intelligence
Container image intelligence
Threat pattern library
Misconfiguration knowledge base
Attack-pattern correlation
Emerging threat detection
Threat-informed risk scoring
Security intelligence updates
Threat intelligence history

Simulation and Testing Module

The Simulation and Testing Module provides controlled security testing before deployment.

Capabilities

IaC simulation
What-if analysis
Configuration comparison
Pre-deployment testing
Deployment impact analysis
Policy impact analysis
Security regression testing
Infrastructure test scenarios
Sandbox validation
Attack-path simulation
Remediation simulation
Configuration change preview

AI Security Hackathon Module

The AI Security Hackathon Module provides isolated environments where AI systems can test and evaluate one another’s security capabilities.

AI-versus-AI Testing

AI attacker agents
AI defender agents
AI red-team agents
AI blue-team agents
AI security analyst agents
AI code-review agents
AI infrastructure-security agents
AI policy agents
AI remediation agents
Multi-agent competitions
Agent-versus-agent testing
Automated security challenges
Security benchmark competitions
Infrastructure security challenges
Blind testing scenarios
Repeated adversarial testing
Automated challenge generation
Configurable difficulty
Agent performance scoring
Detection accuracy scoring
Remediation accuracy scoring
False-positive measurement
False-negative measurement
Explainability scoring
Response-time measurement
Resource-efficiency measurement

Hackathon Isolation

Every hackathon environment must operate within an explicit security boundary.

Dedicated sandbox environments
Ephemeral environments
Container isolation
Virtual machine isolation where required
Network segmentation
Default-deny networking
Explicit network allowlists
No unrestricted internet access
No production access
No production credentials
No CI/CD credential access
No host credential access
No unrelated repository access
No unrestricted filesystem access
No privileged containers
Restricted system calls
CPU limits
Memory limits
Storage limits
Process limits
Execution time limits
API allowlists
Short-lived credentials
Automatic credential revocation
Secret isolation
Controlled artifact exchange
Immutable sandbox boundaries
Automatic environment destruction

Authorized Test Targets

AI agents may interact only with explicitly authorized targets.

Synthetic infrastructure
Intentionally vulnerable IaC
Disposable cloud environments
Local test clusters
Ephemeral Kubernetes environments
Temporary Terraform environments
Mock APIs
Simulated cloud services
Security challenge environments
Synthetic credentials
Synthetic secrets
Synthetic identities
Synthetic datasets

Production infrastructure must never be used as an AI hackathon target.

Agent Capability Boundaries

Every participating AI must receive an explicit capability profile.

Read permissions
Write permissions
Execute permissions
Network permissions
API permissions
File permissions
Tool permissions
Target restrictions
Action restrictions
Time restrictions
Resource restrictions

Aurea must enforce these capabilities externally.

AI Attack Simulation

Authorized attacker agents may evaluate isolated targets for:

IaC misconfigurations
Excessive privileges
Public exposure
Weak network controls
Insecure storage
Missing encryption
Weak authentication
Kubernetes weaknesses
Container weaknesses
Policy violations
Configuration weaknesses
Infrastructure attack paths
Security regressions

All testing must remain within authorized environments.

AI Defense Simulation

Defender agents may:

Detect simulated attacks
Identify vulnerable configurations
Analyze attack paths
Recommend mitigations
Generate remediation patches
Apply approved fixes
Re-scan infrastructure
Validate remediation
Monitor simulated environments
Update defensive policies
Produce incident reports

Independent Evaluation

The evaluation system must remain independent from competing agents.

Deterministic scoring where possible
Independent evaluation engine
Reproducible challenges
Reproducible environments
Evidence-based scoring
Attack success measurement
Detection measurement
Remediation measurement
Regression measurement
Resource consumption measurement
Complete test logs
Immutable result records
Challenge replay

Hackathon Security Controls

Sandbox policy enforcement
Network policy enforcement
Capability enforcement
Resource enforcement
Execution monitoring
Process monitoring
File-access monitoring
API monitoring
Credential monitoring
Secret redaction
Security event logging
Anomaly detection
Escape detection
Abuse detection
Automatic agent termination
Automatic sandbox termination
Emergency kill switch
Environment destruction after testing

Escape Prevention

Sandbox escape attempts must be treated as security events.

Aurea should automatically terminate or quarantine an execution attempting to:

Access unauthorized files
Access unauthorized services
Obtain elevated privileges
Escape its execution environment
Access host resources
Access production systems
Access unauthorized credentials
Circumvent network restrictions
Modify security controls
Disable monitoring
Modify the evaluator
Modify scoring mechanisms

Hackathon Modes

AI versus AI
AI versus baseline
AI versus challenge
Multi-agent battle
Cooperative defense
Red team versus blue team
Remediation race
Security regression challenge
Human versus AI
AI tournament

Hackathon Reporting

Each competition should produce a complete security report containing:

Participating agents
Agent versions
Models used
Tool permissions
Challenge configuration
Target configuration
Security controls
Attack attempts
Successful findings
Defensive detections
Remediation actions
Failed actions
Sandbox violations
Resource consumption
Execution times
Scores
Reproducibility information
Security recommendations

API and Integration Module

The API and Integration Module provides programmatic access to Aurea.

Capabilities

REST API
GraphQL API
CLI API access
Webhooks
Event-driven integrations
Authentication
Authorization
API key management
Short-lived credentials
Integration policies
Rate limiting
Audit logging

Plugin System

Aurea supports optional plugin modules that extend the core system without requiring modifications to core modules.

Plugins must use documented interfaces and must operate within Aurea’s security and permission model.

Optional Plugin Modules

IaC Parser Plugins

Additional IaC languages
Additional configuration formats
Custom parsers
Organization-specific formats

Cloud Provider Plugins

Additional public cloud providers
Private cloud platforms
Edge environments
Infrastructure platforms
Cloud management systems

Compliance Plugins

Industry-specific frameworks
Regional frameworks
Organizational standards
Custom regulatory mappings
Internal security standards

Security Rule Plugins

Community rules
Organization-specific rules
Industry-specific rules
Experimental detection rules
Research rules
Custom vulnerability patterns

AI Provider Plugins

Local AI models
Self-hosted models
Open-source AI models
Optional external AI providers
Specialized security models
Custom inference engines

AI provider plugins must not bypass Aurea’s data protection, permission, or isolation controls.

Threat Intelligence Plugins

Vulnerability databases
Security advisory feeds
Threat intelligence systems
Organization-specific intelligence
Security research feeds

CI/CD Plugins

Additional pipeline systems
Build systems
Deployment systems
GitOps systems
Release systems

Cloud Runtime Plugins

Runtime monitoring systems
Cloud event systems
Kubernetes runtime systems
Container runtime systems
Infrastructure management systems

Notification Plugins

Slack
Microsoft Teams
Discord
Email
Webhooks
Incident management systems
Security operations systems

SIEM and SOAR Plugins

Elastic
Splunk
Grafana
Cortex XSOAR
Other compatible security platforms

Reporting Plugins

Custom dashboards
Custom report formats
Executive reporting systems
Compliance reporting systems
Audit systems

Ticketing Plugins

Issue trackers
Security ticketing systems
Project management systems
Remediation workflows

Storage Plugins

Local storage
Object storage
Database systems
Security data warehouses

Plugins must not weaken Aurea’s security model.

Plugin Security Requirements

Every plugin must:

Declare required capabilities
Declare required permissions
Declare required network access
Declare required data access
Use authenticated interfaces
Follow least-privilege requirements
Respect Aurea policy enforcement
Respect service isolation
Provide version information
Provide dependency information
Support security validation
Generate auditable activity
Avoid unauthorized data collection
Avoid unauthorized external communication

Plugins must not automatically receive access to secrets, production infrastructure, CI/CD credentials, or unrestricted network resources.

Automation Module

The Automation Module orchestrates recurring and event-driven security workflows.

Capabilities

Scheduled scans
Event-driven scans
Commit-triggered scans
Pull request-triggered scans
Merge-triggered scans
Deployment-triggered scans
Cloud-event-triggered scans
Automatic report generation
Automatic ticket creation
Automatic notification routing
Automatic remediation proposals
Approval-based remediation
Automated compliance evidence collection
Automated security score updates
Automated AI security competitions
Automated challenge provisioning
Automated sandbox provisioning
Automated sandbox destruction

Knowledge Base Module

The Knowledge Base Module provides structured security intelligence for deterministic and AI-assisted analysis.

Capabilities

Security knowledge base
IaC pattern library
Secure configuration library
Misconfiguration archetypes
Remediation pattern library
Compliance knowledge base
Threat knowledge base
AI retrieval
Organization-specific knowledge
Project-specific security context
Historical finding context
Versioned security intelligence
Adversarial testing knowledge
AI security benchmark knowledge

Audit Module

The Audit Module records security-relevant Aurea activity.

Capabilities

Security finding history
Policy history
Configuration history
Remediation history
AI decision history
Agent activity history
Plugin activity history
Administrative activity history
Hackathon activity history
Sandbox events
Authentication events
Authorization events
Security violations
Immutable audit records

Security Module

The Security Module provides security controls for Aurea itself.

Capabilities

Secure-by-default configuration
Local-first operation
Offline operation
Data minimization
Configurable telemetry
Secrets redaction
Sensitive-data protection
Encrypted communications
Secure credential handling
Least-privilege execution
AI sandboxing
Agent isolation
Plugin isolation
Service isolation
Network segmentation
Zero-trust service communication
Human approval for high-impact actions
Immutable audit logging
Supply-chain security
Signed releases
Dependency verification
Reproducible builds
Continuous security validation
Security testing of Aurea

Open Source and Community Module

The Open Source and Community Module supports community participation and extension.

Capabilities

Open-source core
Transparent security rules
Community rule contributions
Community plugins
Community policy packs
Community compliance packs
Community AI models
Public security knowledge
Open training datasets
Open security benchmarks
Community hackathons
Community AI challenges
Rule development framework
Plugin development framework
AI agent development framework
Contributor recognition
Security disclosure process
Security research participation

Benchmarking Module

The Benchmarking Module provides reproducible evaluation of Aurea and participating AI systems.

Capabilities

Security benchmarks
IaC security benchmarks
AI security benchmarks
Agent benchmarks
Detection benchmarks
Remediation benchmarks
Compliance benchmarks
Performance benchmarks
Resource-efficiency benchmarks
Regression benchmarks
Reproducible test environments
Standardized scoring
Benchmark history
Comparative analysis

Future Expansion

Aurea may support future capabilities including:

Self-healing IaC
Autonomous security governance
Autonomous security testing
Predictive compliance
Predictive remediation
Cross-project intelligence
Cross-environment intelligence
Advanced attack-path reasoning
Autonomous infrastructure security agents
Security policy evolution
Continuous security optimization
Advanced infrastructure simulation
Federated security intelligence
Privacy-preserving collaborative learning
Autonomous AI security tournaments
Continuous adversarial AI evaluation

Future capabilities must preserve Aurea’s security, isolation, transparency, and human-governance requirements.

Security Requirements

Aurea must prioritize the protection of:

Infrastructure source code
Credentials
Secrets
AI model inputs
AI model outputs
Security findings
Compliance information
Cloud credentials
CI/CD credentials
Runtime credentials
Audit records
Customer data
Organizational security information

No module, plugin, integration, or AI agent may bypass the Aurea security model.

AI Safety Requirements

AI systems operating within Aurea must be treated as untrusted components.

AI systems must not independently:

Expand their permissions
Disable security controls
Disable monitoring
Access unauthorized services
Access production infrastructure
Access unauthorized credentials
Modify their own security boundaries
Modify the evaluation system
Modify scoring mechanisms
Circumvent network controls
Escape an authorized sandbox

High-impact actions must be governed by explicit policy and configurable human approval.

Service Isolation Requirements

All Aurea services must communicate through explicitly authorized interfaces.

Service isolation must include:

Authentication
Authorization
Capability validation
Network segmentation
API allowlisting
Resource limits
Credential isolation
Secret isolation
Logging
Monitoring
Failure containment
Automatic termination where required

A compromised service must not automatically provide access to unrelated services or infrastructure.

Performance Requirements

Aurea should support:

Incremental scanning
Parallel analysis
Changed-file analysis
Caching
Configurable scan depth
Resource limits
Pipeline-friendly execution
Local execution
Large repository analysis
Large infrastructure analysis

Security accuracy must take precedence over scan speed where the two conflict.

Reliability Requirements

Aurea should provide:

Deterministic security rules
Reproducible scans
Versioned policies
Versioned rules
Versioned AI configurations
Scan history
Failure reporting
Graceful error handling
Plugin failure isolation
Agent failure isolation
Sandbox failure isolation
Recoverable workflows

Observability Requirements

Aurea should provide visibility into:

Scan activity
Security findings
Policy decisions
AI decisions
Agent actions
Plugin actions
Remediation actions
API activity
Service activity
Sandbox activity
Hackathon activity
Resource usage
Security violations

Core Design Principles Summary

Aurea is built around:

Open source
Modular architecture
Local-first operation
Vendor neutrality
Cloud neutrality
Human-in-the-loop governance
Explainable AI
Security by default
Least privilege
Zero-trust architecture
Airtight service isolation
Explicit capability boundaries
Independent evaluation
Reproducibility
Transparency
Extensibility
Developer-friendly security
CI/CD-native operation
Controlled automation
Controlled AI autonomy
Continuous security validation

Specification Branding License (SBL)

Standard

Fully AGPL-3.0+ compliant system
Copyleft enforced for network deployments
Required attribution:
- Roxanne Ardary
- https://www.roxanneardary.com/

Optional

Specification Branding License (SBL)
- Attribution-free commercial deployment
- Pricing based on scale, usage, and deployment scope
- https://roxanneardary.com/aurea/

License & Notice Requirements

Aurea is released under the GNU Affero General Public License v3.0 or later (AGPL-3.0+).

By contributing to this project, you agree that your contributions will also be released under this license.

Please note the following:

All contributions must comply with the AGPL-3.0+ terms.
Under Section 7 of the license, all redistributions, forks, and derivative works must preserve attribution to Roxanne Ardary and roxanneardary.com.
Aurea specifications are free to use with attribution. A Specification Branding License can be negotiated upon request.
The project’s notice.md file tracks attribution requirements and contributor acknowledgments. Any update that adds new contributors or modifies attribution should also update notice.md.
When submitting a pull request, ensure that any new files maintain the attribution headers where applicable.
Network-deployed versions of this software must also remain fully AGPL-3.0+ compliant, including exposure of source code modifications when applicable under the license.

For full legal details, please refer to the AGPL-3.0+ license and the project’s notice.md file.

Notice – Aurea

Attribution Requirement: Under Section 7 of the AGPL 3.0+ license, all redistributions, forks, and derivative works, including network-deployed versions of this project, must provide attribution to Roxanne Ardary and roxanneardary.com.

Contributors

This file tracks contributors and their specific contributions to the project.

Roxanne Ardary, roxanneardary.com – March 28, 2026
Created the repository for Aurea. Created and developed the Aurea Infrastructure-as-Code security specification.
[Add other contributors here] – [Date]
[Describe contribution in one sentence]

License – Aurea

This repository is licensed under the GNU Affero General Public License v3.0 or later (AGPL-3.0+).

Key Points:

You are free to use, modify, and distribute the code.
All redistributions, forks, and derivative works or network-deployed versions must also be licensed under AGPL-3.0+ and provide attribution to Roxanne Ardary and roxanneardary.com as required under Section 7 of the license.
The software is provided “as is,” without warranty of any kind.

For the full license text, see GNU AGPL-3.0 License.