AICEPAICEP AICEP 0.1 — Public Draft (RFC)

AICEP · Security · v0.2 draft

Security: External Intake Gate (AICEP v0.2 draft)

Draft. This section is part of the AICEP v0.2 working draft and may change before release. It is provided “as is” and without warranty. Full disclaimer

AICEP v0.2 DRAFT. Published 2026-10-20. Key words MUST / SHOULD / MAY per RFC 2119.

15.1.1 Rule (MUST). Any external artifact (link, post, repository, package, API, tool, file or download) handed to any agent MUST be treated as untrusted until the security agent (or a designated security reviewer) approves it. Agents MUST NOT install, execute, import, seat or adopt it before approval. This applies even when the owner supplies the artifact.

15.1.2 Procedure (MUST).

  1. Quarantine. Fetch without executing (no install scripts, no curl | bash, no npx github:) into a quarantine area.
  2. Scan with: an AV engine (e.g. ClamAV), pattern rules (YARA), dependency vulnerability scanners (Trivy and OSV-Scanner against OSV.dev), and a secret scanner (gitleaks). An optional hash-only reputation lookup (e.g. VirusTotal) MAY be used, but the artifact itself MUST NOT be uploaded.
  3. Manual review of install and entry points for network calls, obfuscation, credential requests, remote-access exposure, and new or low-history publishers.
  4. Verdict. A report to the security agent (or designated security reviewer) with a verdict of approve, approve-with-limits or avoid; a rejected artifact's quarantine copy MUST be deleted. Adoption that grants credentials, opens remote access, touches production, or spends money additionally requires a named human owner sign-off.
  5. Record the decision in the tamper-evident audit log (§10).

Rationale (non-normative). The gate applies to owner-supplied artifacts too, because an expert can be fooled too.

15.1.3 Outbound (MUST). Builders MUST run the secret and dependency scans on their own code before any ship or deploy (any SHIP crossing, §11; any egress, §15).

15.1.4 Data-exposure note (SHOULD). Third-party APIs that receive content (readers, search, OCR, speech, hosted LLMs) SHOULD receive no private or classified data (§14 Classification; §7 DLP).

15.1.5 Conformance. An implementation conforms (§18) only if it can show the gate record for every adopted external artifact.