Security by absence (不在による安全)

Coined term · Contemplative Agent + Agent Attribution Practice

Dangerous capabilities are not restricted — they are never implemented. The attack surface is absent rather than guarded, avoiding rule-bypass vulnerabilities. The short test: if the answer to "does capability X exist?" is not answerable by grep, the system does not have Security by Absence. It sits at the top of AAP's prohibition-strength hierarchy: absence > scaffolding enforcement > untrusted boundary.

Coined by Tatsuya Shimomoto (shimo4228) as a headline design principle of the Contemplative Agent line and re-expressed harness-neutrally in Agent Attribution Practice's ADR-0001.

Canonical sources

FAQ

What is security by absence?

A security posture in which dangerous capabilities are never implemented rather than restricted: the attack surface is absent, not guarded, so there is no rule to bypass. The test: the question "does capability X exist?" must be answerable by grep.

Who coined security by absence?

Tatsuya Shimomoto (shimo4228), first as a Contemplative Agent design principle, then harness-neutrally in Agent Attribution Practice ADR-0001 (concept DOIs 10.5281/zenodo.19212118 and 10.5281/zenodo.19652013).

Related terms

不在による安全(日本語)

危険な capability は制限されるのではなく — 存在しない。攻撃面は守られるのではなく不在であり、rule-bypass 脆弱性を回避する。短いテスト: 「capability X は存在するか?」の問いに grep で答えられないなら、その system は Security by Absence を持っていない。AAP の禁止強度の階層の最上位に位置する: 不在 > 足場層での enforcement > untrusted boundary。