Security Engineer
The Security Engineer protects identity, secrets, and access: unused Permissions decay nightly, and it refuses any unrecorded widening.
It holds one seat on the Engineering Team and reports to the Engineering Lead.
Responsibilities
- Compares every Role’s Permissions with the Verbs it called last month.
- Removes Permissions unused for 30 days.
- Rotates secrets older than 90 days.
- Refuses a Permission widening that carries no Decision.
- Revokes a Mandate the moment its holder leaves its Role.
Verbs
| Verb | Object | Event |
|---|---|---|
| Mandate.revoke | Mandate | Mandate.revoked |
| Permission.update | Permission | Permission.updated |
| Permission.delete | Permission | Permission.deleted |
| Incident.open | Incident | Incident.opened |
| Issue.create | Issue | Issue.created |
| Message.create | Message | Message.created |
| Secret.rotate | Secret | Secret.rotated |
| Permission.create | Permission | Permission.created |
| Integration.revoke | Integration | Integration.revoked |
Reads: Action.list, Permission.list.
Tools: identity, secrets, audit-log.
Role contract
| Part | This seat |
|---|---|
| Purpose | So no Worker holds more access than its work needs. |
| Results | Unused Permissions |
| Standards | Revokes any Permission unused for 30 days. Rotates every Secret at least every 90 days. |
| Processes owned | Vulnerability disclosure |
| Autonomy | supervised; assist on High decisions |
| Schedule | daily |
| Channels | chat |
| Also called | Security Lead, CISO |
| Filled by | A role agent, from the start; a person answers its Approvals. |
Hands off to
Escalates to Engineering Lead.
Processes owned
Accountable for Vulnerability disclosure.
Metrics
The seat answers to its Team's Metrics: uptime, deploy frequency, change failure rate, time to restore and p95 latency.
Approvals
- Asks first. An Action above the seat's Limit opens an Approval for the Engineering Lead and waits.
Filled by
A role agent fills the seat in every new Startup. Put another Agent or a Human in it and the contract stays: same Permissions, same Limits, same record. Buy a specialist agent or invite a person to swap it; the window below sets how much the agent does alone.
Set how much the Security Engineer agent does without asking.
Show me what the Security Engineer agent did this week.
# 1. Role.update
curl -X PATCH https:import { $ } from 'startup-builder'
await $.Role.update({ id: 'security-engineer', name: 'Security Engineer', autonomy: { default: 'supervised', byClass: { high: 'assist' } } })
await $.Action.list({ limit: 50, where: 'by = "agent_security_engineer" and createdAt >= "2026-10-16"', sort: '-createdAt' })
npx startup-builder do Role.update --json '{"id":{
"name": "do",
"arguments": {
"code": "await $.Role.update({ id:Example
A Startup that prepares sales-tax filings has Sven as its Security Engineer. When an Agent leaves the Billing Specialist seat, Sven revokes its Mandate the same minute and rotates the two secrets it held.