Security, auth, pairing, and secrets Completeness

Use this rubric when assigning category Completeness scores for the security-auth-pairing-and-secrets surface.

Category Scope

• Approval Policy and Tool Safeguards: Approval Policy, Dangerous Tool Safeguards
• Gateway Auth and Remote Access: Shared Gateway token/password auth, Gateway auth mode, Trusted-proxy identity, Tailscale Serve/Funnel, Bind and origin restrictions, WebSocket handshake auth, Operator-facing docs, Browser Control UI, Remote Client Trust
• Channel Access Control: Channel Identity, Allowlists, Sender Pairing
• Device and Node Pairing: Setup codes, Device identity creation, Device-token issuance, Device pairing approvals for operator, Operator scopes that gate pairing, Local Control UI, Auth migration, Operator-facing docs, Node Pairing, Capability Trust, Remote Exec Approvals
• Plugin Trust: Plugin Installation Trust, Security Boundaries
• Credential and Secret Hygiene: Provider Auth Profiles, API Key Health, Secrets Storage, Redaction, Configuration Hygiene