Build with the secure SDLC
State the security baseline - threat modeling, least privilege, and IAM - and follow the secure development lifecycle that shifts security left, so each stage of a change carries its own security gate instead of a check bolted on at the end.
Units5
Duration27 min
Levelintermediate
By the end of this module, you'll be able to:
- Distinguish the security controls the Security Standard owns (IAM, secrets, PKI, security operations) from the process the Secure Development Lifecycle Standard owns.
- Explain the security baseline: STRIDE-style threat modeling, least privilege, and identity and access management for humans, workloads, and agents.
- Map security as a gate onto each stage of the request lifecycle - from a threat model at the design gate to remediation SLAs after release - rather than treating it as an afterthought.
- Say when a threat model is mandatory and what enforces the no-new-high-or-critical gate, and follow each rule to the standard that owns the detail.
Prerequisites
- Familiarity with the AGENTS floor and the request lifecycle your changes move through.
- Basic understanding of Git, pull requests, and CI gates.
Units
- 01Introduction4 min
- 02The security baseline7 min
- 03The secure development lifecycle8 min
- 04Knowledge check5 min
- 05Summary3 min
Related
- Design and version an API Shape a clean, consistent API against a clear API design standard - resources, standard methods, typed errors, cursor pagination, idempotency - then version and deprecate it under a versioning policy so no consumer is ever broken without consent.
- Apply the naming standards Name a new identifier, file, repo, or branch the way an AI-native org does - keyword-first, no redundant prefix, cased by role - and tell a functional keyword apart from a product codename, so your first artifact passes the naming gate by default.
- Read the pipeline that ships your change Follow a change from a pull request through the canonical CI stage set to a gated production deploy - the ordered gates a pipeline runs, why CI is the real gate, and how the deployment model promotes one signed artifact dev to staging to prod.