POLICY DRAFT

Secure systems /

END-USER DEVICES & SERVER CONFIGURATION — TECHNICAL BASELINE

WORKFLOW-FIRST SECURITY MODEL REV. 007 / DRAFT

SUBMIT REQUEST SERVICES OVERVIEW
POLICY 007
FOR REVIEW
1.

PROTECTED END-USER DEVICES

PROTECTED DEVICE / XRAY PATH

Protected NixOS laptops, GrapheneOS phones, and delegated connectivity for normal corporate access.

Controls fail closed when XRAY or the connectivity VM is unavailable.

  • Connectivity hardware stays outside the host OS
  • XRAY-only corporate access
  • Protected recovery after custody loss
REQUEST BASELINE
DEVICE-007FAIL-CLOSED
2.

DECLARATIVE SERVER CONFIGURATION

NIXOS / DECLARATIVE STATE

NixOS declarations, sops-nix secrets, XRAY ingress, SSO, storage, and telemetry share one controlled baseline.

VIEW BASELINE
SERVER-007SOURCE OF TRUTH
3.

CONTROLLED WORKFLOWS & RECOVERY

VERIFIED BASELINE
CHECKLIST
RECOVERY / ACCESS CONTROL

Approved tools map each workflow to a boundary: documents, Matrix, mail isolation, research, and external collaboration.

TECHNICAL BASELINE INQUIRY

Map the next boundary.

Identify the workflow. Use the approved tool and security boundary.

REQUEST POLICY REVIEW