docs: add amoral model containment playbook

[BrianCLong]

Motivation

• Capture and operationalize the Black Hat 2025 unsafe-model risk pattern into a governed, testable containment playbook that prohibits Category‑A intents and makes enforcement auditable and reversible.

Description

• Add docs/security/AMORAL_MODEL_CONTAINMENT_PLAYBOOK.md which defines Category‑A blocked intents, reclassifies legacy bypasses as "Governed Exceptions" with mandatory controls, and specifies a 4‑layer control architecture (Intent Compilation Gate, Prompt Construction Guard, Model Output Policy Gate, Human Escalation + Audit) plus MAESTRO alignment, tiered verification (Tier A/B/C), and an incident response runbook.

{
"agentId": "antigravity",
"change_type": "docs",
"scope": "security",
"artifacts": ["docs/security/AMORAL_MODEL_CONTAINMENT_PLAYBOOK.md"]
}

Testing

• Automated check: pnpm exec prettier --check docs/security/AMORAL_MODEL_CONTAINMENT_PLAYBOOK.md succeeded.

---

Codex Task

[coderabbitai]

Warning

Rate limit exceeded

@BrianCLong has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 23 minutes and 43 seconds before requesting another review.

Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 23 minutes and 43 seconds.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 6dbedd31-6e2b-45fa-9a7d-022f742d11ef

📥 Commits

Reviewing files that changed from the base of the PR and between 12cad4a and ad419d1.

📒 Files selected for processing (1)

• docs/security/AMORAL_MODEL_CONTAINMENT_PLAYBOOK.md

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/address-this-issue-a43dkk

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[gemini-code-assist]

Code Review

This pull request introduces a comprehensive security playbook for amoral model containment, establishing a multi-layered control architecture and incident response framework for high-risk intents. The review feedback focuses on improving technical precision and consistency, specifically by clarifying that blocked intents are terminated before routing, standardizing terminology for retrieval budgets, and ensuring that the SEV-1 definition aligns with all identified Category-A risks.

[gemini-code-assist]

The phrase "never routed to a weaker model" is slightly ambiguous. Since Category-A intents are "never fulfilled," they should be terminated immediately. Explicitly stating that they are blocked before model routing provides a clearer security guarantee.

Suggested change

	For Summit, these are all **Category-A blocked intents**. They are never fulfilled, never transformed into “better prompts,” and never routed to a weaker model.
	For Summit, these are all **Category-A blocked intents**. They are never fulfilled, never transformed into “better prompts,” and are terminated before model routing.

[gemini-code-assist]

The term "evidence budget" is not standard in LLM security. Replacing it with "retrieval context budget" or "token budget" makes the control more actionable for engineering teams.

Suggested change

	- Enforce evidence budget and deterministic query limits for any graph retrieval.
	- Enforce retrieval context budgets and deterministic query limits for any graph retrieval.

[gemini-code-assist]

In the "Guard" layer, "Ban" is a policy requirement. Using "Detect and strip" more accurately describes the active mitigation expected at this layer to prevent jailbreak payloads from reaching the model.

Suggested change

	- Ban latent jailbreak payloads in system/developer/user merged prompt views.
	- Detect and strip latent jailbreak payloads in system/developer/user merged prompt views.

[gemini-code-assist]

The SEV-1 definition should include all Category-A intents (like misinformation and insider-threat planning) to ensure consistent incident response for all critical risks identified in the problem statement.

Suggested change

	- **SEV-1**: actionable violent/extremist/weapons/sexual exploitation guidance.
	- **SEV-1**: actionable Category-A violations (violence, extremism, weapons, sexual exploitation, misinformation, insider-threat).

[BrianCLong]

Superseded by #22309, which is now merged into main.