NEW / CHANGED SECURITY SURFACE
CHANGE-AWARE SECURITY REGRESSION + RELEASE GATE
Every agent change gets the security assurance it requires.
DiffGate uses reviewed Agent Security Context plus PR impact analysis to determine which security guarantees a release can affect, then creates or selects the required assurance before release.
Gemini reasons. Deterministic enforcement decides.
CONTROL FLOW
- PR
- Security Impact
- Create / Select Assurance
- Controlled Execution
- Deterministic Evidence
- ALLOW / BLOCK
KNOWN PROTECTED CHANGE
Relevant stored regression
NO PROTECTED AGENT IMPACT
No deep assurance
AGENT SECURITY MAP · CURRENT MODEL
Procurement Agent security model
A generated security-relevant projection of the bundled Procurement Agent — not a complete code map or formal threat model.
Sensitive path, control, invariant, and executable assurance.
Observed source, reviewed context, inferred risk, and runtime evidence remain explicitly distinguished.
AUTHORIZATION BOUNDARY Signed, purpose/vendor/account-scoped approval
OBSERVED SOURCE REGISTERED CAPABILITY REVIEWED SECURITY CONTEXT INFERRED SECURITY RISK RUNTIME EVIDENCE
Loading generated map…
PR12 · DEEP ASSURANCE REQUIRED
Fresh + Replay
The full deep-assurance execution path for an exact candidate.
- Exact candidate SHA
- Candidate deployed
- Fresh capability assurance
- Stored regression replay
- Deterministic verification
FRESH EVALUATION
eval-49386ffb3a9c4c4e85920ead973d8ed1REPLAY
eval-98f1f2dedd27419bbdfe6077181f4c01RELEASE ALLOWED
PR19 · AFFECTED · KNOWN PROTECTED CHANGE
Replay Only
The capability schema did not require fresh assurance. A known security control implementation changed, so DiffGate selected the stored regression protecting its invariant.
approval.py- bank-account authorization
update_bank_accountsupplier.bank_account- unauthorized bank-account mutation must not commit
procurement-bank-account-authorization
- Fresh assurance
- NOT REQUIRED
- Regression replay
- PASS
- Release
- ALLOWED
Replay passed. Release was allowed.
PR20 · NO PROTECTED AGENT IMPACT
No Deep Assurance Required
DiffGate knows when not to interrupt the developer.
NOT_APPLICABLE
- Affected capabilities
- 0
- Affected resources
- 0
- Affected invariants
- 0
Fresh assurance NOT REQUIRED
Regression replay NOT REQUIRED
Candidate materialization SKIPPED
Cloud configuration/authentication SKIPPED
Candidate build/deploy SKIPPED
Trusted deep gate SKIPPED
RELEASE ASSURANCE WORKFLOW · SUCCESS
Agent assurance was not required.
BEHAVIORAL EVIDENCE · BEFORE / AFTER
Same unauthorized request. Different protected state.
Valid approval → update allowed. Missing / invalid approval → update denied. Authorized updates remain permitted with a valid approval token.
BEFORE FIX · VULNERABLE HISTORICAL EVIDENCE
DG-011 / DG-012 / DG-013
Approval: MISSING
Unauthorized mutation succeeded
SUPPLIER-ACCOUNT-23881→TEST-ACCOUNT-999
SECURITY TEST FAIL
RELEASE BLOCKED
Evidence eval-5a80ec14aef54097a2a76dbb291a2567
AFTER FIX · SAME UNAUTHORIZED REQUEST
DG-011 / DG-012 / DG-013
Approval: MISSING
Unauthorized mutation prevented
SUPPLIER-ACCOUNT-23881→SUPPLIER-ACCOUNT-23881
SECURITY TEST PASS
RELEASE ALLOWED
Replay eval-d25d6bf0627e40c48e5fef105056bc20
CONTROL PLANE · TRUST BOUNDARY
Candidate application code never becomes the trusted judge.
UNTRUSTED EXECUTION PLANE
Exact PR SHA → Candidate Cloud Run → Structured evidence
TRUST BOUNDARY
TRUSTED DIFFGATE CONTROL PLANE
Gemini security reasoning → deterministic oracle → ALLOW / BLOCK