---
name: bespoke-secure-change
description: Plan and review authentication, authorization, migration, tenant, secret, and rollback-sensitive changes with explicit authority boundaries. Use when a code change can alter access, data isolation, credentials, production state, or recovery behaviour.
---

# Bespoke Secure Change

## Establish the security boundary

1. Identify actors, assets, trust boundaries, authorization checks, data ownership, secrets, and rollback path.
2. Trace the current path from request through validation, policy, persistence, side effects, and user-visible recovery state.
3. Define additive migrations, least-privilege permissions, idempotency, audit evidence, and failure recovery before code.
4. Test authorization, tenant separation, invalid input, race/replay resistance where relevant, rollback, and truthful error states.
5. Require explicit authority before production mutation, credential rotation, data deletion, or external security coordination.

## Keep claims narrow

- Do not claim a formal audit, certification, incident resolution, or provider hardening without recorded evidence.
- Do not log credentials, tokens, personal data, or raw secret-bearing errors.
- Preserve backend authority, recipients, and event triggers unless an approved requirement changes them.