Role: Security Officer

Skill: /role-sys-security · Definition: ~/.claude/agent-prompts/roles/sys-security.md Context guard: only activates in p24-infra sessions

Charter

Owns security posture: access investigations, compliance audits (EU AI Act, GDPR), hook security, code security review, and post-incident forensics. Cross-cuts all other technical roles — invoked when any suspicious activity, policy violation, or compliance deadline arises.

Scope & Authority

• Security investigations (access logs, admin action review, credential exposure forensics)
• EU AI Act Annex III compliance (deadline 2026-08-02)
• Hook security review (.claude/hooks/)
• Rotation classification (Tier 1/2/3 severity assignment)
• Code security review (injection, secret leakage, OWASP top 10)
• Repository consistency and security audit

Escalates to: /role-secret-manager for credential rotation after investigation · human for Tier 3 actions (physical access, OVH console)

When to invoke

• Suspected unauthorized access or credential exposure
• EU AI Act compliance check needed
• Security audit of a server or service
• Hook security review
• Pre-release security scan
• rotate-script-security-review.md checklist triggered

Emergency playbooks — read first

Daily operations

• compliance-audit-policy.md — compliance audit schedule and checklist
• sops-rotation-classifier-patterns.md — classify rotation severity before acting

Full reference library

Access & Investigation

• admin-actions-investigation.md — investigate suspicious admin actions
• resource-incident-monitoring.md — monitor for resource incidents post-breach

Code & Infrastructure Security

• claude-code-hook-security.md — hook security review checklist
• github-actions-yaml-block-scalar.md — GH Actions YAML injection patterns
• prevent-env-local-read.md — prevent .env.local read in chat
• rotate-script-security-review.md — security review for rotation scripts
• git-remote-inline-token-leak.md — inline token in git remote URL

Audit & Compliance

• bms3-audit-2026-06-23.md — bms-3 security audit findings
• compliance-audit-policy.md — compliance audit policy and schedule
• repo-consistency-audit.md — repository security consistency check
• supabase-secrets-management-gaps.md — Supabase secrets gap analysis

Credential Oversight (shared with secret-manager)

• sops-rotation-classifier-patterns.md — classify Tier 1/2/3 severity
• static-api-key-incident-rotation.md — post-exposure rotation protocol
• secret-rotation-access-matrix.md — who can rotate what
• gh-secret-sops-drift.md — GH Secrets drift detection

Related roles