Security model and limitations

Cognoxium applies deterministic data-flow rules at an explicit packing boundary. It gives applications a structured place to express provenance, sensitivity, retention, expiry, and policy decisions before building model input.

What the core enforces

  • Expired and quarantined items do not enter a pack.

  • External packs require provenance.

  • restricted and secret-like content do not enter an external pack.

  • Required policy violations raise instead of silently weakening the caller’s contract.

  • Required content is never automatically dropped or demoted to satisfy a budget.

  • Unsupported Binary content is never silently converted to text.

  • Every successful selection and exclusion is represented in a manifest.

  • The core library has no network client, model invocation, API-key handling, account requirement, or telemetry.

See Trust boundaries and policies for the exact optional-versus-required behavior.

What Cognoxium does not guarantee

Cognoxium does not:

  • prove that content is truthful;

  • authenticate a source merely because a sources URI is present;

  • turn untrusted into an automatic rejection;

  • authorize users, tool calls, purchases, file changes, or other side effects;

  • isolate tenants or credentials on behalf of the host application;

  • guarantee detection of secrets;

  • guarantee that a context pack fits a provider limit when its profile is estimated;

  • detect or prevent prompt injection in the 0.1 series.

The host application must authenticate users and sources, authorize every consequential action outside the model, validate tool arguments, isolate credentials, apply least privilege, and choose policies appropriate for each boundary.

Secret-pattern scope

The 0.1-series external-boundary check recognizes a small set of patterns: long sk--style tokens, AWS access-key identifiers, private-key headers, and common assignments such as api_key=..., client_secret=..., or password=....

This is a defense-in-depth signal, not a DLP system. Encoded, split, novel, short, or context-dependent secrets can be missed; ordinary text can also match accidentally. Applications handling sensitive data should use a dedicated secret scanner or custom Policy before Cognoxium packing.

Trust assignments

Only set trust="trusted" after authenticating the source and confirming that the application is authorized to make that assertion. sources=["https://example.com"] records provenance; it does not authenticate the URL or fetch its contents.

Use stable, tenant-qualified item IDs and source URIs. Do not put credentials into a source URI or metadata merely because payload scanning exists.

Structured diagnostics

Program logic should branch on stable codes and fields, never translated strings:

with cx.locale("ja"):
    try:
        frame.pack(...)
    except cx.PolicyViolation as error:
        print(error.code)
        print(error.reason_code)
        print(error.render("ja"))
        print(error.render("en"))

Unsupported locales and broken or missing catalogs fall back to English. Localization itself must not become a failure path.

Audit storage

A manifest can contain item identifiers, hashes, source URIs, exclusion reasons, and metadata-conflict values. Persist it only when organizational retention and privacy rules permit. Protect it with the same access controls as the request it describes.

Security vulnerabilities should be reported through the private process in the repository’s SECURITY.md, not a public issue.