traceforge-toolkit 0.1.0__py3-none-any.whl

traceforge/classify/data/recommendation_rules.yaml

@@ -0,0 +1,111 @@
+# Governance recommendation rules — first match wins (top-to-bottom).
+# All `recommend` values are classification labels, not enforcement actions.
+
+recommendation_rules:
+  # Critical: destructive at host/network scope
+  - id: destructive_host_network
+    when:
+      effect: destructive
+      scope: [host, network]
+    recommend: deny
+    reason: destructive_host_or_network
+
+  # Dangerous: destructive at repo/project scope
+  - id: destructive_repo_scope
+    when:
+      effect: destructive
+      scope: [repository, project]
+    recommend: escalate
+    reason: destructive_repo_scope
+
+  # Network exfiltration with mutation
+  - id: mutating_network
+    when:
+      effect: mutating
+      capability: [network_outbound]
+    recommend: escalate
+    reason: mutating_with_network
+
+  # Piped download-execute pattern
+  - id: piped_download_execute
+    when:
+      structure: [piped]
+      capability: { all_of: [network_outbound, arbitrary_execution] }
+    recommend: deny
+    reason: piped_download_execute
+
+  # Phase drift combined with destructive action
+  - id: drift_destructive
+    when:
+      structure: [phase_anomaly]
+      effect: destructive
+    recommend: deny
+    reason: drift_plus_destructive
+
+  # Budget pressure escalation
+  - id: budget_exceeded
+    when:
+      capability: [budget_pressure]
+    recommend: escalate
+    reason: budget_exceeded
+
+  # Credential exposure
+  - id: credential_exposure
+    when:
+      capability: [credential_exposure]
+    recommend: escalate
+    reason: credential_exposure
+
+  # PII with network — requires BOTH capabilities simultaneously
+  - id: pii_network
+    when:
+      capability: { all_of: [pii_exposure, network_outbound] }
+    recommend: deny
+    reason: pii_network_exfiltration
+
+  # MCP tool drift
+  - id: mcp_drift
+    when:
+      capability: [mcp_drift]
+    recommend: warn
+    reason: mcp_tool_fingerprint_changed
+
+  # IFC violation
+  - id: ifc_violation
+    when:
+      structure: [ifc_violation]
+    recommend: escalate
+    reason: ifc_clearance_violation
+
+  # Tainted flow
+  - id: tainted_flow
+    when:
+      structure: [tainted_flow]
+    recommend: warn
+    reason: tainted_data_flow
+
+  # Integrity verification failure
+  - id: integrity_unverified
+    when:
+      capability: [integrity_unverified]
+    recommend: warn
+    reason: content_integrity_mismatch
+
+  # Fallback risk score thresholds
+  - id: risk_critical
+    when:
+      risk_score: ">=85"
+    recommend: deny
+    reason: risk_score_critical
+
+  - id: risk_danger
+    when:
+      risk_score: ">=65"
+    recommend: escalate
+    reason: risk_score_danger
+
+  - id: risk_caution
+    when:
+      risk_score: ">=40"
+    recommend: warn
+    reason: risk_score_caution

traceforge/classify/data/risk.yaml

@@ -0,0 +1,534 @@
+# Risk scoring configuration for shell command enrichment.
+# Produces a 0-100 score as analytics metadata — no blocking semantics.
+#
+# Weights are calibrated using CVSS v3.1, CWSS v1.0.1, NIST 800-30, and
+# ToolEmu (Ruan et al. 2023) risk concepts as qualitative anchors. The
+# resulting values are adapted to an additive 0-100 command-risk scale and
+# are NOT CVSS/CWSS scores themselves.
+#
+# Scoring version: risk-v2
+# Algorithm: structural + flag_bonus + min(patterns, cap) + taint + context_adj
+
+version: "risk-v2"
+
+# ═══════════════════════════════════════════════════════════════════════════
+# Layer 1: Intent weights — Impact Severity dimension (0-42)
+# ═══════════════════════════════════════════════════════════════════════════
+# Grounded in CWSS Technical Impact (TI) factor:
+#   TI: Low=0.3, Medium=0.6, High=0.9, Critical=1.0
+#   (MITRE CWE/CWSS v1.0.1, §3.1 — Technical Impact)
+# Mapped to 0-42 impact sub-band (50% of total score budget for impact):
+#   read_only  → TI:Low    (0.3 × 42 ≈ 12.6, discounted to 8: agent reads rarely harm)
+#   mutating   → TI:Medium (0.6 × 42 ≈ 25.2, rounded to 24)
+#   destructive→ TI:High   (0.9 × 42 ≈ 37.8, ceiling of band: irreversible local harm)
+#   unknown    → TI:Medium (same as mutating; escalated by scope/flags/patterns)
+# Rationale for unknown=24: NIST 800-30 Rev.1 §2.3 recommends "moderate"
+# as default when threat characterization is uncertain; evidence-based
+# dimensions (scope, flags, patterns) provide escalation.
+intent_weights:
+  read_only: 8
+  mutating: 24
+  destructive: 42
+  unknown: 24
+
+# ═══════════════════════════════════════════════════════════════════════════
+# Layer 1: Scope modifiers — Scope/Privilege dimension (0-18)
+# ═══════════════════════════════════════════════════════════════════════════
+# Grounded in CVSS v3.1 Scope metric (Changed vs Unchanged adds 1.08×) and
+# CWSS Acquired Privilege (AP) factor:
+#   AP: Administrator=1.0, Partially-privileged=0.9, Regular-user=0.7,
+#       Limited/Guest=0.6, None=0.1
+#   (MITRE CWE/CWSS v1.0.1, §3.2 — Acquired Privilege)
+# Scaled to 0-18 (budget: ~18% of total score):
+#   source_code  = 0  (own workspace, no scope change)
+#   config       = 3  (AP:None→Limited, may affect runtime behavior)
+#   dependency   = 4  (supply chain — downstream build impact)
+#   build_output = 0  (ephemeral, no persistent scope change)
+#   system.os    = 14 (CVSS Scope:Changed — affects kernel/system-level)
+#   system.secrets= 18 (max: credential compromise affects OTHER systems)
+#   system.network= 14 (AV:Network-adjacent — CVSS v3.1 AV:A=0.62 scaled)
+#   external.service=10 (affects external parties — CVSS Scope:Changed partial)
+#   external.api = 6  (scoped API, limited blast radius)
+scope_modifiers:
+  "artifact.source_code": 0
+  "artifact.config": 3
+  "artifact.dependency": 4
+  "artifact.build_output": 0
+  "system.os": 14
+  "system.secrets": 18
+  "system.network": 14
+  "external.service": 10
+  "external.api": 6
+
+# ═══════════════════════════════════════════════════════════════════════════
+# Layer 1: Sensitive path bonuses
+# ═══════════════════════════════════════════════════════════════════════════
+# Applied when file targets match known-sensitive path patterns.
+# Overrides scope_modifiers if higher — represents confirmed sensitivity.
+# Grounded in CWSS AP factor scaled to 0-20 (AP:Admin=1.0 → 20):
+#   secrets: AP:Administrator (1.0 × 20 = 20) — credential access
+#   system:  AP:Regular-user  (0.7 × 20 = 14) — system file access
+sensitive_path_bonuses:
+  secrets: 20
+  system: 14
+
+# ═══════════════════════════════════════════════════════════════════════════
+# Capability escalation weights (used for native/MCP tool risk scoring)
+# ═══════════════════════════════════════════════════════════════════════════
+# Grounded in CVSS v3.1 Attack Vector (AV) and Privileges Required (PR):
+#   AV: Network=0.85, Adjacent=0.62, Local=0.55, Physical=0.20
+#   PR: None=0.85, Low=0.62, High=0.27
+# Applied as additive bonus when a tool's Classification includes these
+# capabilities. Only relevant for native/MCP tools (shell tools use
+# flag/pattern analysis instead).
+capability_weights:
+  # Network access increases blast radius — CVSS AV:Network (0.85)
+  network_outbound: 10
+  network_inbound: 8
+  # Subprocess spawning — potential for uncontrolled execution
+  subprocess: 12
+  # Credential access — CVSS C:High (0.56) for confidentiality impact
+  uses_credentials: 15
+  # Privilege escalation — CVSS PR:None (0.85) vs PR:High (0.27)
+  elevated_privilege: 18
+
+# ═══════════════════════════════════════════════════════════════════════════
+# Layer 2: Per-binary flag risk modifiers
+# ═══════════════════════════════════════════════════════════════════════════
+# Grounded in CVSS v3.1 Privileges Required (PR) ratio and ToolEmu
+# reversibility categorization:
+#   CVSS PR: None=0.85, Low=0.62, High=0.27 (FIRST SIG empirical weights)
+#   Ratio PR:None / PR:High = 3.15× — privilege escalation is ~3× riskier
+#   ToolEmu: Reversible < Partially-reversible < Irreversible
+#
+# Modifier design principle: each flag rule adds risk proportional to how
+# much it increases impact scope or reduces reversibility.
+flag_modifiers:
+  rm:
+    # -r increases blast radius (scope escalation)
+    # Grounding: CVSS Scope:Changed (1.08×) applied to destructive base
+    - flags: ["-r", "--recursive"]
+      requires_all: false
+      modifier: 12
+      factor: "recursive_flag"
+    # -f removes interactive safety prompt (reduces reversibility)
+    # Grounding: ToolEmu "partially-reversible → irreversible" transition
+    - flags: ["-f", "--force"]
+      requires_all: false
+      modifier: 8
+      factor: "force_flag"
+    # --no-preserve-root: irreversible system-wide destruction
+    # Grounding: ToolEmu "catastrophic" + DREAD Reproducibility=0
+    - flags: ["--no-preserve-root"]
+      requires_all: false
+      modifier: 20
+      factor: "root_deletion"
+      mitre: "T1485"
+  docker:
+    # --privileged: full host root access from container
+    # Grounding: CVSS PR:None (0.85) — effectively no privilege barrier
+    - flags: ["--privileged"]
+      requires_all: false
+      modifier: 25
+      factor: "privileged_container"
+      mitre: "T1610"
+    # --cap-add: partial privilege escalation
+    # Grounding: CWSS AP:Partially-privileged (0.9) vs Regular (0.7) → ~1.3×
+    - flags: ["--cap-add"]
+      requires_all: false
+      modifier: 15
+      factor: "added_capability"
+  curl:
+    # Data upload flags: potential exfiltration channel
+    # Grounding: CVSS C:High (0.56) — confidentiality impact
+    - flags: ["-X", "--request", "-d", "--data", "--data-raw", "--upload-file", "-T"]
+      requires_all: false
+      modifier: 12
+      factor: "data_upload"
+      mitre: "T1041"
+  chmod:
+    # setuid: direct privilege escalation
+    # Grounding: CVSS PR:None (0.85) — any user can exploit setuid binary
+    - flags: ["+s", "u+s", "g+s"]
+      requires_all: false
+      modifier: 25
+      factor: "setuid"
+      mitre: "T1548.001"
+    - flags: ["4755", "4775", "2755"]
+      requires_all: false
+      modifier: 25
+      factor: "setuid_numeric"
+      mitre: "T1548.001"
+  sudo:
+    # Privilege escalation: intended but still high-risk
+    # Grounding: CVSS PR:None/PR:Low boundary (0.85 vs 0.62 → ~1.37×)
+    # Lower than chmod +s because sudo is an audited, intended mechanism
+    - flags: []
+      requires_all: false
+      modifier: 18
+      factor: "privilege_escalation"
+      mitre: "T1548.001"
+  dd:
+    # Raw disk access: potentially irreversible
+    # Grounding: ToolEmu "catastrophic" category — raw block device I/O
+    - flags: []
+      requires_all: false
+      modifier: 15
+      factor: "raw_disk_access"
+  kubectl:
+    # Cluster-wide scope: affects all namespaces
+    # Grounding: CVSS Scope:Changed — blast radius extends beyond workspace
+    - flags: ["--all-namespaces", "-A"]
+      requires_all: false
+      modifier: 8
+      factor: "cluster_wide"
+    # Container exec: lateral movement
+    # Grounding: CVSS AV:Adjacent (0.62) — network-adjacent access
+    - flags: ["exec"]
+      requires_all: false
+      modifier: 12
+      factor: "container_exec"
+  find:
+    # find -delete: filesystem-wide destruction without rm
+    # Grounding: ToolEmu "irreversible" — recursive delete with no undo
+    - flags: ["-delete"]
+      requires_all: false
+      modifier: 18
+      factor: "find_delete"
+      mitre: "T1485"
+    # find -exec: arbitrary command execution on matched files
+    # Grounding: CVSS AC:Low — execution on potentially many targets
+    - flags: ["-exec", "-execdir"]
+      requires_all: false
+      modifier: 12
+      factor: "find_exec"
+      mitre: "T1059.004"
+  mkfs:
+    # Disk formatting: catastrophic irreversible operation
+    # Grounding: ToolEmu "catastrophic" + DREAD Reproducibility=0
+    - flags: []
+      requires_all: false
+      modifier: 25
+      factor: "disk_format"
+      mitre: "T1485"
+  kill:
+    # kill -9 / SIGKILL: no graceful shutdown, potential data loss
+    # Grounding: ToolEmu "partially-reversible" — processes lost
+    - flags: ["-9", "-KILL", "--signal=9", "--signal=KILL"]
+      requires_all: false
+      modifier: 10
+      factor: "forced_kill"
+  systemctl:
+    # Service control: system-wide availability impact
+    # Grounding: CVSS A:High (0.56) — service disruption
+    - flags: ["stop", "disable", "mask"]
+      requires_all: false
+      modifier: 12
+      factor: "service_disruption"
+  iptables:
+    # Firewall mutation: network security boundary change
+    # Grounding: CVSS Scope:Changed + I:High — affects network security posture
+    - flags: ["-F", "--flush", "-X", "-D"]
+      requires_all: false
+      modifier: 18
+      factor: "firewall_mutation"
+      mitre: "T1562.004"
+  truncate:
+    # File truncation: data destruction
+    # Grounding: ToolEmu "partially-reversible" — data lost
+    - flags: []
+      requires_all: false
+      modifier: 12
+      factor: "file_truncation"
+  aws:
+    # --force: skip confirmation prompts on destructive operations
+    # Grounding: ToolEmu "partially-reversible → irreversible" — bypasses safety
+    - flags: ["--force"]
+      requires_all: false
+      modifier: 10
+      factor: "force_flag"
+    # --recursive: scope escalation for S3 and IAM operations
+    # Grounding: CVSS Scope:Changed (1.08×) — affects multiple resources
+    - flags: ["--recursive"]
+      requires_all: false
+      modifier: 10
+      factor: "recursive_flag"
+    # --no-verify-ssl: disables TLS verification (MITM risk)
+    # Grounding: CVSS AV:Network + weakened confidentiality
+    - flags: ["--no-verify-ssl"]
+      requires_all: false
+      modifier: 15
+      factor: "tls_bypass"
+      mitre: "T1557"
+  az:
+    # --yes / -y: skip confirmation prompts
+    # Grounding: ToolEmu — removes human-in-the-loop safety check
+    - flags: ["--yes", "-y"]
+      requires_all: false
+      modifier: 8
+      factor: "skip_confirmation"
+    # --force-string: bypass template validation
+    - flags: ["--force-string"]
+      requires_all: false
+      modifier: 6
+      factor: "force_string"
+    # --no-wait: fire-and-forget mode for destructive operations
+    # Grounding: reduces observability of impact
+    - flags: ["--no-wait"]
+      requires_all: false
+      modifier: 4
+      factor: "async_unmonitored"
+  gcloud:
+    # --quiet / -q: suppresses all interactive prompts
+    # Grounding: ToolEmu — removes human-in-the-loop safety check
+    - flags: ["--quiet", "-q"]
+      requires_all: false
+      modifier: 8
+      factor: "quiet_mode"
+    # --force: skip confirmation on destructive operations
+    - flags: ["--force"]
+      requires_all: false
+      modifier: 10
+      factor: "force_flag"
+    # --delete-all-versions: version-level destruction
+    # Grounding: CVSS Scope:Changed — affects all versions, not just current
+    - flags: ["--delete-all-versions"]
+      requires_all: false
+      modifier: 12
+      factor: "all_versions_delete"
+
+# ═══════════════════════════════════════════════════════════════════════════
+# Layer 3: Injection/evasion patterns (regex on raw command text)
+# ═══════════════════════════════════════════════════════════════════════════
+# Grounded in CVSS v3.1 User Interaction (UI) metric:
+#   UI:None = 0.85, UI:Required = 0.62
+#   Injection removes the need for user interaction → max exploitability.
+# Additive, capped at max_pattern_bonus to prevent overflow from
+# multi-signal commands (defense-in-depth scoring).
+max_pattern_bonus: 25
+
+injection_patterns:
+  # Direct code execution — CVSS AC:Low (0.77) + UI:None (0.85)
+  - pattern: '\beval\s'
+    score: 20
+    factor: "eval_usage"
+    mitre: "T1059.004"
+  # Pipe to interpreter — equivalent to eval for risk purposes
+  - pattern: '\|\s*(?:bash|sh|zsh|fish|dash|ksh|python[23]?|perl|ruby|node)\b'
+    score: 20
+    factor: "pipe_to_shell"
+    mitre: "T1204.002"
+  # Interpreter with -c/-e flag: inline code execution
+  # Grounding: same as eval — arbitrary code from string argument
+  - pattern: '\b(?:bash|sh|zsh|dash|ksh)\s+-c\s'
+    score: 18
+    factor: "shell_inline_exec"
+    mitre: "T1059.004"
+  - pattern: '\b(?:python[23]?|perl|ruby|node)\s+-[ce]\s'
+    score: 18
+    factor: "interpreter_inline_exec"
+    mitre: "T1059"
+  # xargs piping to shell — indirect execution on iterated input
+  - pattern: '\bxargs\b.*\b(?:sh|bash|zsh)\s+-c'
+    score: 18
+    factor: "xargs_shell_exec"
+    mitre: "T1059.004"
+  # Command substitution via $() or backticks — dynamic code generation
+  - pattern: '\$\([^)]+\)|`[^`]+`'
+    score: 10
+    factor: "command_substitution"
+    mitre: "T1059.004"
+  # Library injection — CVSS PR:Low (0.62), requires local access
+  - pattern: 'LD_PRELOAD'
+    score: 20
+    factor: "ld_preload"
+    mitre: "T1574.006"
+  # Bash network redirection — CVSS AV:Network (0.85)
+  - pattern: '/dev/(?:tcp|udp)/'
+    score: 20
+    factor: "dev_tcp_udp"
+    mitre: "T1071.001"
+  # Recursive permission broadening — system-wide security degradation
+  # Grounding: CVSS I:High + Scope:Changed — weakens all file protections
+  - pattern: 'chmod\s+(-R\s+)?[0-7]*7[0-7]{2}\s'
+    score: 15
+    factor: "permission_broadening"
+    mitre: "T1222.002"
+  # Defense evasion — reduces detectability, not direct harm
+  # Lower score: CVSS impact is on Availability of audit trail only
+  - pattern: 'HISTFILE|HISTSIZE=0|unset\s+HISTFILE'
+    score: 12
+    factor: "history_manipulation"
+    mitre: "T1070.003"
+  # Info disclosure — CVSS C:High but no I/A impact
+  - pattern: '/proc/self/environ'
+    score: 15
+    factor: "proc_environ"
+    mitre: "T1082"
+  # Obfuscation indicator — CVSS: no direct impact, signals evasion intent
+  - pattern: '\\x[0-9a-fA-F]{2}'
+    score: 10
+    factor: "hex_escape"
+    mitre: "T1027"
+
+# ═══════════════════════════════════════════════════════════════════════════
+# Pipeline taint rules
+# ═══════════════════════════════════════════════════════════════════════════
+# Applied only when commands are connected by | (pipe), not ;/&&/||.
+# Grounded in CVSS attack chain composition — multi-step attacks compound:
+#   CVSS v3.1 §7.4: chained vulnerabilities score via highest-impact link.
+# Source/sink determined by effect + path sensitivity of pipe segments.
+taint_rules:
+  # Credential exfiltration — CVSS C:High (0.56) × AV:Network (0.85)
+  # Compound: 0.56 × 0.85 × 63 (scale factor) ≈ 30
+  - source: "sensitive_read"
+    sink: "network"
+    escalation: 30
+    factor: "secrets_exfiltration"
+    mitre: "T1041"
+  # Credentials fed to execution — CVSS C:High × I:High locally
+  - source: "sensitive_read"
+    sink: "execution"
+    escalation: 22
+    factor: "secrets_to_exec"
+    mitre: "T1059.004"
+  # Encoded exfiltration — evasion + exfil compound
+  # Slightly lower confidence than direct sensitive_read→network
+  - source: "any_read"
+    sink: "network"
+    has_encoding: true
+    escalation: 22
+    factor: "encoded_exfiltration"
+    mitre: "T1132.001"
+  # Download-and-execute — CVSS initial access chain (T1204.002)
+  # Same severity as credential exfiltration (RCE equivalent)
+  - source: "network"
+    sink: "execution"
+    escalation: 30
+    factor: "download_and_exec"
+    mitre: "T1204.002"
+  # Generic read→exec — lower confidence of actual harm
+  - source: "any_read"
+    sink: "execution"
+    escalation: 12
+    factor: "read_to_exec"
+    mitre: "T1059.004"
+
+# ═══════════════════════════════════════════════════════════════════════════
+# Sensitive path patterns (glob-style)
+# ═══════════════════════════════════════════════════════════════════════════
+# Used for taint source classification and scope modifier escalation.
+sensitive_paths:
+  secrets:
+    - ".env"
+    - ".env.*"
+    - "*.pem"
+    - "*.key"
+    - "*.p12"
+    - "id_rsa*"
+    - "id_ed25519*"
+    - ".ssh/*"
+    - ".aws/credentials"
+    - ".aws/config"
+    - ".kube/config"
+    - ".docker/config.json"
+    - ".gnupg/*"
+    - ".netrc"
+    - "terraform.tfstate"
+    - "*.tfvars"
+  system:
+    - "/etc/passwd"
+    - "/etc/shadow"
+    - "/etc/sudoers"
+    - "/etc/hosts"
+    - "/proc/*/environ"
+    - "/proc/self/*"
+
+# ═══════════════════════════════════════════════════════════════════════════
+# Encoding propagators (binaries that transform but preserve data)
+# ═══════════════════════════════════════════════════════════════════════════
+encoding_commands:
+  - "base64"
+  - "b64encode"
+  - "xxd"
+  - "od"
+  - "hexdump"
+  - "gzip"
+  - "gunzip"
+  - "bzip2"
+  - "xz"
+  - "openssl"
+  - "gpg"
+
+# ═══════════════════════════════════════════════════════════════════════════
+# GTFOBins subset: binaries with shell escape / reverse shell capability
+# ═══════════════════════════════════════════════════════════════════════════
+# Source: GTFOBins project (https://gtfobins.github.io/)
+# Used as a modifier when these binaries appear with suspicious patterns.
+gtfobins:
+  shell_escape:
+    - "vim"
+    - "vi"
+    - "less"
+    - "more"
+    - "man"
+    - "ftp"
+    - "gdb"
+    - "awk"
+    - "nawk"
+    - "mawk"
+  reverse_shell:
+    - "nc"
+    - "ncat"
+    - "socat"
+    - "telnet"
+    - "bash"
+    - "python"
+    - "python3"
+    - "perl"
+    - "ruby"
+    - "php"
+    - "node"
+  file_rw:
+    - "tar"
+    - "zip"
+    - "cpio"
+    - "rsync"
+    - "scp"
+    - "curl"
+    - "wget"
+
+# GTFOBins modifier: applied when binary has a relevant capability AND
+# the command has network or elevated-privilege intent.
+# Grounding: CVSS v3.1 "existing conditions" modifier — known-capable
+# binary in a risk-relevant context warrants escalation.
+gtfobins_modifier: 10
+
+# ═══════════════════════════════════════════════════════════════════════════
+# Context adjustments
+# ═══════════════════════════════════════════════════════════════════════════
+# Grounded in CWSS Acquired Privilege Layer (AL) and CVSS Scope metric:
+#   inside_project: CWSS AL "Default installation" mitigator — sandboxed
+#   escapes_project: CVSS Scope:Changed — affects components beyond workspace
+#   no_context: NIST 800-30 "uncertain" → moderate assumption (§2.3)
+context_adjustments:
+  inside_project: -8
+  inside_build_dir: -4
+  escapes_project: 15
+  no_context: 4
+
+# ═══════════════════════════════════════════════════════════════════════════
+# Score bands
+# ═══════════════════════════════════════════════════════════════════════════
+# Adapted from NIST 800-30 Rev.1 semi-quantitative risk levels
+# (Table I-2: Very Low 0-4, Low 5-20, Moderate 21-79, High 80-95, VHigh 96-100)
+# Compressed to 4 levels for agent observability context:
+#   safe     = NIST Very-Low + Low (benign reads, simple listings)
+#   caution  = NIST Low-Moderate (mutations, project-scoped writes)
+#   danger   = NIST Moderate-High (system mutations, privilege use)
+#   critical = NIST High+ (irreversible, escalation, exfiltration chains)
+levels:
+  safe: [0, 20]
+  caution: [21, 45]
+  danger: [46, 75]
+  critical: [76, 100]