H.9.2 Trust Boundaries

Security starts by naming which subject may perform which operation on which resource.

• Bazel visibility enforces dependency policy during analysis; it does not conceal source or authorize runtime behavior.
• Review approval governs a change to policy or code; it does not grant builders, artifacts, or workloads ambient trust.
• Treat repository hosts, CI, remote execution, caches, registries, deployment systems, and runtimes as distinct trust zones.
• State what each access check, query, signature, attestation, and audit record proves—and what it cannot prove.
• Link ordinary approval roles to Ownership while keeping security-specific authorization explicit.