Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Security Architecture · ancoleman | DecimalAI

Securityby ancoleman

Security Architecture

Design comprehensive security architectures using defense-in-depth, zero trust principles, threat modeling (STRIDE, PASTA), and control frameworks (NIST CSF, CIS Controls, ISO 27001).

Never made a case worseMaintained

SkillScore

SkillScore96/100

Test results 96

Safety

3/3 safety checks passed

Code scan
Intent
Content

What it changes

87%96%of test cases passed +9 pts

Without skill20 of 23

With skill22 of 23

2 fixed20 passed either way1 still failing0 broke

Measured on gemini-3.6-flash8/21/2026v1

Track record

Agent runs: 0; All time

See one task, with and without the skill

One test taskWhen presenting a modern 2025 Defense-in-Depth framework to executive leadership, how many distinct defense layers should be represented in the structured security architecture model, and which layer sits between Endpoint Protection and Data Layer?

Without the skillMissed

With the skillPassed

Same model, same task. Answers are capped and redacted.

Use this skill

Your agent runs on

Adds every file the skill has, pinned so you can update it. No account needed.

pip install "decimalai>=0.15"
decimalai skills add ancoleman-architecting-security
claude --plugin-dir "$(git rev-parse --show-toplevel 2>/dev/null || pwd)/.agents"

The same install from Python, for a notebook or a setup script.

Install

pip install "decimalai>=0.15"

Add the skill

from decimalai import skillpkg

# Writes .agents/skills and .decimal/skills.toml. Safe to run twice.
result = skillpkg.add("ancoleman-architecting-security")
if result.exit_code:
    raise SystemExit(result.problems)

print("Added. Start Claude Code with the command below.")

Start Claude Code with it

claude --plugin-dir "$(git rev-parse --show-toplevel 2>/dev/null || pwd)/.agents"

Type these in a Claude Code session. No account or API key. It writes the skill and any files it bundles, and asks first when its safety rating isn't Passed.

Add the DecimalAI plugin, once

/plugin marketplace add decimal-labs/decimalai-claude-plugins
/plugin install decimalai@decimalai

Install this skill

/decimalai:install ancoleman-architecting-security

The plugin needs python3 and curl on your machine.

No Python or account. Claude Code picks it up in its next session.

Save it into your project

curl -fsSL --create-dirs -o .claude/skills/ancoleman-architecting-security/SKILL.md https://app.decimal.ai/s/ancoleman-architecting-security/SKILL.md

Copy SKILL.md

Save it in your project, as

.claude/skills/ancoleman-architecting-security/SKILL.md

This gets SKILL.md only. The skill's 13 other files are not included.

Other ways to add it

Claude Code docs

agent_config() hands your agent the skill. With no DecimalAI key it reads your project's files and sends nothing. Needs SDK 0.27 or newer.

Install

pip install "decimalai[claude-agent-sdk]"
decimalai skills add ancoleman-architecting-security

Add it to your agent

import asyncio

from claude_agent_sdk import ClaudeAgentOptions
from decimalai.claude_agent_sdk import agent_config

# With no DECIMAL_API_KEY this reads the skills your project lists, from disk.
support = agent_config("support", fallback="You are a helpful agent.")

async def main():
    question = "Hello!"
    async with support.run(question) as run:  # one user message, one run
        async for message in run.query(options=ClaudeAgentOptions(max_turns=6)):
            print(message)

# In a notebook or async code: await main()
asyncio.run(main())

Prefer its own loader? ClaudeAgentOptions(plugins=[skills_plugin()], skills="all") reads the same folder. Use one or the other: a skill delivered both ways reaches the prompt twice.

The same install from Python, for a notebook or a setup script. agent_config() hands your agent the skill. With no DecimalAI key it reads your project's files and sends nothing. Needs SDK 0.27 or newer.

Install

pip install "decimalai[claude-agent-sdk]"

Add it to your agent

from decimalai import skillpkg

# Writes .agents/skills and .decimal/skills.toml. Safe to run twice.
result = skillpkg.add("ancoleman-architecting-security")
if result.exit_code:
    raise SystemExit(result.problems)

import asyncio

from claude_agent_sdk import ClaudeAgentOptions
from decimalai.claude_agent_sdk import agent_config

# With no DECIMAL_API_KEY this reads the skills your project lists, from disk.
support = agent_config("support", fallback="You are a helpful agent.")

async def main():
    question = "Hello!"
    async with support.run(question) as run:  # one user message, one run
        async for message in run.query(options=ClaudeAgentOptions(max_turns=6)):
            print(message)

# In a notebook or async code: await main()
asyncio.run(main())

Prefer its own loader? ClaudeAgentOptions(plugins=[skills_plugin()], skills="all") reads the same folder. Use one or the other: a skill delivered both ways reaches the prompt twice.

No DecimalAI package. The whole skill goes in every prompt, and nothing pins or updates it.

Copy SKILL.md

Save it in your project, as

.agents/skills/ancoleman-architecting-security/SKILL.md

Give it to your agent

import asyncio
from pathlib import Path
from claude_agent_sdk import ClaudeAgentOptions, query

skill = Path(".agents/skills/ancoleman-architecting-security/SKILL.md").read_text()
options = ClaudeAgentOptions(system_prompt=f"You are a helpful agent.\n\n{skill}", max_turns=6)

async def main():
    async for message in query(prompt="Hello!", options=options):
        print(message)

# In a notebook or async code: await main()
asyncio.run(main())

This gets SKILL.md only. The skill's 13 other files are not included.

Other ways to add it

Claude Agent SDK docs

agent_config() hands your agent the skill. With no DecimalAI key it reads your project's files and sends nothing. Needs SDK 0.27 or newer.

Install

pip install "decimalai[openai-agents]"
decimalai skills add ancoleman-architecting-security

Add it to your agent

from agents import Agent, Runner
from decimalai.openai_agents import agent_config

# With no DECIMAL_API_KEY this reads the skills your project lists, from disk.
support = agent_config("support", fallback="You are a helpful agent.")

agent = Agent(
    name=support.name,
    instructions=support.instructions,  # your prompt, then the skill list
    tools=[*support.tools],             # your tools, then load_skill
)
# In a notebook or async code: result = await Runner.run(agent, "Hello!")
result = Runner.run_sync(agent, "Hello!")

Using SandboxAgent? capabilities=[Shell(), decimalai.openai_agents.sandbox_skills()] points its own loader at the same folder.

Install

pip install "decimalai[openai-agents]"

Add it to your agent

from decimalai import skillpkg

# Writes .agents/skills and .decimal/skills.toml. Safe to run twice.
result = skillpkg.add("ancoleman-architecting-security")
if result.exit_code:
    raise SystemExit(result.problems)

from agents import Agent, Runner
from decimalai.openai_agents import agent_config

# With no DECIMAL_API_KEY this reads the skills your project lists, from disk.
support = agent_config("support", fallback="You are a helpful agent.")

agent = Agent(
    name=support.name,
    instructions=support.instructions,  # your prompt, then the skill list
    tools=[*support.tools],             # your tools, then load_skill
)
# In a notebook or async code: result = await Runner.run(agent, "Hello!")
result = Runner.run_sync(agent, "Hello!")

Using SandboxAgent? capabilities=[Shell(), decimalai.openai_agents.sandbox_skills()] points its own loader at the same folder.

No DecimalAI package. The whole skill goes in every prompt, and nothing pins or updates it.

Copy SKILL.md

Save it in your project, as

.agents/skills/ancoleman-architecting-security/SKILL.md

Give it to your agent

from pathlib import Path
from agents import Agent, Runner

skill = Path(".agents/skills/ancoleman-architecting-security/SKILL.md").read_text()
agent = Agent(name="support", instructions=f"You are a helpful agent.\n\n{skill}")
# In a notebook or async code: result = await Runner.run(agent, "Hello!")
result = Runner.run_sync(agent, "Hello!")

This gets SKILL.md only. The skill's 13 other files are not included.

Other ways to add it

OpenAI Agents docs

agent_config() hands your agent the skill. With no DecimalAI key it reads your project's files and sends nothing. Needs SDK 0.27 or newer.

Install

pip install "decimalai[openai]"
decimalai skills add ancoleman-architecting-security

Add it to your agent

import json

from openai import OpenAI
from decimalai.openai import agent_config

client = OpenAI()
# With no DECIMAL_API_KEY this reads the skills your project lists, from disk.
support = agent_config("support", fallback="You are a helpful agent.")


def lookup_order(order_id: str) -> str:
    return f"Order {order_id} shipped yesterday."


# Your tools, as Chat Completions takes them, and what answers each.
TOOLS = [{"type": "function", "function": {
    "name": "lookup_order",
    "description": "Look up the status of an order.",
    "parameters": {"type": "object", "properties": {"order_id": {"type": "string"}},
                   "required": ["order_id"]},
}}]
FUNCTIONS = {"lookup_order": lookup_order}

question = "Where is order A1001?"
with support.run(question) as run:  # one user message, one run
    # run.system is your prompt, then the skill list.
    messages = [{"role": "system", "content": run.system}, run.message]
    while True:
        reply = client.chat.completions.create(
            model="gpt-5.4-mini",
            messages=messages,
            tools=[*TOOLS, *run.tools],  # your tools, then load_skill
        ).choices[0].message
        messages.append(reply)
        if not reply.tool_calls:
            break
        for call in reply.tool_calls:
            # load_skill is answered by the run; your own tools by FUNCTIONS.
            function = FUNCTIONS.get(call.function.name)
            messages.append(run.tool_result(call) or {
                "role": "tool", "tool_call_id": call.id,
                "content": function(**json.loads(call.function.arguments)) if function
                else f"There is no tool named {call.function.name!r}.",
            })
print(reply.content)

# The Responses API takes run.response_tools instead of run.tools.

Install

pip install "decimalai[openai]"

Add it to your agent

from decimalai import skillpkg

# Writes .agents/skills and .decimal/skills.toml. Safe to run twice.
result = skillpkg.add("ancoleman-architecting-security")
if result.exit_code:
    raise SystemExit(result.problems)

import json

from openai import OpenAI
from decimalai.openai import agent_config

client = OpenAI()
# With no DECIMAL_API_KEY this reads the skills your project lists, from disk.
support = agent_config("support", fallback="You are a helpful agent.")


def lookup_order(order_id: str) -> str:
    return f"Order {order_id} shipped yesterday."


# Your tools, as Chat Completions takes them, and what answers each.
TOOLS = [{"type": "function", "function": {
    "name": "lookup_order",
    "description": "Look up the status of an order.",
    "parameters": {"type": "object", "properties": {"order_id": {"type": "string"}},
                   "required": ["order_id"]},
}}]
FUNCTIONS = {"lookup_order": lookup_order}

question = "Where is order A1001?"
with support.run(question) as run:  # one user message, one run
    # run.system is your prompt, then the skill list.
    messages = [{"role": "system", "content": run.system}, run.message]
    while True:
        reply = client.chat.completions.create(
            model="gpt-5.4-mini",
            messages=messages,
            tools=[*TOOLS, *run.tools],  # your tools, then load_skill
        ).choices[0].message
        messages.append(reply)
        if not reply.tool_calls:
            break
        for call in reply.tool_calls:
            # load_skill is answered by the run; your own tools by FUNCTIONS.
            function = FUNCTIONS.get(call.function.name)
            messages.append(run.tool_result(call) or {
                "role": "tool", "tool_call_id": call.id,
                "content": function(**json.loads(call.function.arguments)) if function
                else f"There is no tool named {call.function.name!r}.",
            })
print(reply.content)

# The Responses API takes run.response_tools instead of run.tools.

No DecimalAI package. The whole skill goes in every prompt, and nothing pins or updates it.

Copy SKILL.md

Save it in your project, as

.agents/skills/ancoleman-architecting-security/SKILL.md

Give it to your agent

from pathlib import Path
from openai import OpenAI

client = OpenAI()
skill = Path(".agents/skills/ancoleman-architecting-security/SKILL.md").read_text()
reply = client.chat.completions.create(
    model="gpt-5.4-mini",
    messages=[
        {"role": "system", "content": f"You are a helpful agent.\n\n{skill}"},
        {"role": "user", "content": "Hello!"},
    ],
).choices[0].message

This gets SKILL.md only. The skill's 13 other files are not included.

Other ways to add it

OpenAI SDK docs

agent_config() hands your agent the skill. With no DecimalAI key it reads your project's files and sends nothing. Needs SDK 0.27 or newer.

Install

pip install "decimalai[anthropic]"
decimalai skills add ancoleman-architecting-security

Add it to your agent

import anthropic
from decimalai.anthropic import agent_config

client = anthropic.Anthropic()
# With no DECIMAL_API_KEY this reads the skills your project lists, from disk.
support = agent_config("support", fallback="You are a helpful agent.")

question = "Hello!"
with support.run(question) as run:  # one user message, one run
    answer = client.beta.messages.tool_runner(
        model="claude-haiku-5-5",
        max_tokens=4096,
        system=run.system,     # your prompt, then the skill list
        tools=[*run.tools],    # your tools, then load_skill
        messages=[{"role": "user", "content": question}],
    ).until_done()

Install

pip install "decimalai[anthropic]"

Add it to your agent

from decimalai import skillpkg

# Writes .agents/skills and .decimal/skills.toml. Safe to run twice.
result = skillpkg.add("ancoleman-architecting-security")
if result.exit_code:
    raise SystemExit(result.problems)

import anthropic
from decimalai.anthropic import agent_config

client = anthropic.Anthropic()
# With no DECIMAL_API_KEY this reads the skills your project lists, from disk.
support = agent_config("support", fallback="You are a helpful agent.")

question = "Hello!"
with support.run(question) as run:  # one user message, one run
    answer = client.beta.messages.tool_runner(
        model="claude-haiku-5-5",
        max_tokens=4096,
        system=run.system,     # your prompt, then the skill list
        tools=[*run.tools],    # your tools, then load_skill
        messages=[{"role": "user", "content": question}],
    ).until_done()

No DecimalAI package. The whole skill goes in every prompt, and nothing pins or updates it.

Copy SKILL.md

Save it in your project, as

.agents/skills/ancoleman-architecting-security/SKILL.md

Give it to your agent

from pathlib import Path
import anthropic

client = anthropic.Anthropic()
skill = Path(".agents/skills/ancoleman-architecting-security/SKILL.md").read_text()
reply = client.messages.create(
    model="claude-haiku-5-5",
    max_tokens=4096,
    system=f"You are a helpful agent.\n\n{skill}",
    messages=[{"role": "user", "content": "Hello!"}],
)

This gets SKILL.md only. The skill's 13 other files are not included.

Other ways to add it

Anthropic docs

agent_config() hands your agent the skill. With no DecimalAI key it reads your project's files and sends nothing. Needs SDK 0.27 or newer.

Install

pip install "decimalai[google-genai]"
decimalai skills add ancoleman-architecting-security

Add it to your agent

from google import genai
from google.genai import types
from decimalai.google_genai import agent_config

client = genai.Client()
# With no DECIMAL_API_KEY this reads the skills your project lists, from disk.
support = agent_config("support", fallback="You are a helpful agent.")


def lookup_order(order_id: str) -> str:
    return f"Order {order_id} shipped yesterday."


# Your functions, as declarations for the model, and what answers each.
TOOLS = [{"function_declarations": [{
    "name": "lookup_order",
    "description": "Look up the status of an order.",
    "parameters_json_schema": {"type": "object", "properties": {"order_id": {"type": "string"}},
                               "required": ["order_id"]},
}]}]
FUNCTIONS = {"lookup_order": lookup_order}

question = "Where is order A1001?"
with support.run(question) as run:  # one user message, one run
    config = types.GenerateContentConfig(
        system_instruction=run.system,     # your prompt, then the skill list
        tools=[*TOOLS, *run.tool_params],  # your functions, then load_skill
    )
    contents = [{"role": "user", "parts": [{"text": run.message}]}]
    while True:
        response = client.models.generate_content(
            model="gemini-3.5-flash", contents=contents, config=config,
        )
        if not response.function_calls:
            break
        contents.append(response.candidates[0].content)
        parts = []
        for call in response.function_calls:
            # load_skill is answered by the run; your own functions by FUNCTIONS.
            # A loop of your own rather than automatic function calling, which
            # raises KeyError when the model asks for a function you did not pass.
            function = FUNCTIONS.get(call.name)
            parts.append(run.tool_result(call) or {"function_response": {
                "name": call.name, "id": call.id,
                "response": {"result": function(**(call.args or {})) if function
                             else f"There is no function named {call.name!r}."},
            }})
        contents.append({"role": "user", "parts": parts})
print(response.text)

Install

pip install "decimalai[google-genai]"

Add it to your agent

from decimalai import skillpkg

# Writes .agents/skills and .decimal/skills.toml. Safe to run twice.
result = skillpkg.add("ancoleman-architecting-security")
if result.exit_code:
    raise SystemExit(result.problems)

from google import genai
from google.genai import types
from decimalai.google_genai import agent_config

client = genai.Client()
# With no DECIMAL_API_KEY this reads the skills your project lists, from disk.
support = agent_config("support", fallback="You are a helpful agent.")


def lookup_order(order_id: str) -> str:
    return f"Order {order_id} shipped yesterday."


# Your functions, as declarations for the model, and what answers each.
TOOLS = [{"function_declarations": [{
    "name": "lookup_order",
    "description": "Look up the status of an order.",
    "parameters_json_schema": {"type": "object", "properties": {"order_id": {"type": "string"}},
                               "required": ["order_id"]},
}]}]
FUNCTIONS = {"lookup_order": lookup_order}

question = "Where is order A1001?"
with support.run(question) as run:  # one user message, one run
    config = types.GenerateContentConfig(
        system_instruction=run.system,     # your prompt, then the skill list
        tools=[*TOOLS, *run.tool_params],  # your functions, then load_skill
    )
    contents = [{"role": "user", "parts": [{"text": run.message}]}]
    while True:
        response = client.models.generate_content(
            model="gemini-3.5-flash", contents=contents, config=config,
        )
        if not response.function_calls:
            break
        contents.append(response.candidates[0].content)
        parts = []
        for call in response.function_calls:
            # load_skill is answered by the run; your own functions by FUNCTIONS.
            # A loop of your own rather than automatic function calling, which
            # raises KeyError when the model asks for a function you did not pass.
            function = FUNCTIONS.get(call.name)
            parts.append(run.tool_result(call) or {"function_response": {
                "name": call.name, "id": call.id,
                "response": {"result": function(**(call.args or {})) if function
                             else f"There is no function named {call.name!r}."},
            }})
        contents.append({"role": "user", "parts": parts})
print(response.text)

No DecimalAI package. The whole skill goes in every prompt, and nothing pins or updates it.

Copy SKILL.md

Save it in your project, as

.agents/skills/ancoleman-architecting-security/SKILL.md

Give it to your agent

from pathlib import Path
from google import genai
from google.genai import types

client = genai.Client()
skill = Path(".agents/skills/ancoleman-architecting-security/SKILL.md").read_text()
response = client.models.generate_content(
    model="gemini-3.5-flash",
    contents="Hello!",
    config=types.GenerateContentConfig(system_instruction=f"You are a helpful agent.\n\n{skill}"),
)

This gets SKILL.md only. The skill's 13 other files are not included.

Other ways to add it

Gemini API docs

agent_config() hands your agent the skill. With no DecimalAI key it reads your project's files and sends nothing. Needs SDK 0.27 or newer.

Install

pip install "decimalai[langchain]" langchain-openai
decimalai skills add ancoleman-architecting-security

Add it to your agent

from langchain.agents import create_agent
from decimalai.langchain import agent_config

# With no DECIMAL_API_KEY this reads the skills your project lists, from disk.
support = agent_config("support", fallback="You are a helpful agent.")

agent = create_agent(
    "openai:gpt-5.4-mini",
    tools=[],                         # your tools; the middleware adds load_skill
    middleware=[support.middleware],  # your prompt, the skill list and load_skill
)
result = agent.invoke({"messages": [{"role": "user", "content": "Hello!"}]})

Install

pip install "decimalai[langchain]" langchain-openai

Add it to your agent

from decimalai import skillpkg

# Writes .agents/skills and .decimal/skills.toml. Safe to run twice.
result = skillpkg.add("ancoleman-architecting-security")
if result.exit_code:
    raise SystemExit(result.problems)

from langchain.agents import create_agent
from decimalai.langchain import agent_config

# With no DECIMAL_API_KEY this reads the skills your project lists, from disk.
support = agent_config("support", fallback="You are a helpful agent.")

agent = create_agent(
    "openai:gpt-5.4-mini",
    tools=[],                         # your tools; the middleware adds load_skill
    middleware=[support.middleware],  # your prompt, the skill list and load_skill
)
result = agent.invoke({"messages": [{"role": "user", "content": "Hello!"}]})

No DecimalAI package. The whole skill goes in every prompt, and nothing pins or updates it.

Copy SKILL.md

Save it in your project, as

.agents/skills/ancoleman-architecting-security/SKILL.md

Give it to your agent

from pathlib import Path
from langchain.agents import create_agent

skill = Path(".agents/skills/ancoleman-architecting-security/SKILL.md").read_text()
agent = create_agent("openai:gpt-5.4-mini", tools=[], system_prompt=f"You are a helpful agent.\n\n{skill}")
result = agent.invoke({"messages": [{"role": "user", "content": "Hello!"}]})

This gets SKILL.md only. The skill's 13 other files are not included.

Other ways to add it

LangChain docs

CrewAI's own skill loader reads the installed folder. No DecimalAI account needed.

Install

pip install "decimalai>=0.16" "crewai>=1.15.27"
decimalai skills add ancoleman-architecting-security

Add it to your agent

import decimalai.crewai
from crewai import Agent, Crew, Task

agent = Agent(
    role="Support", goal="Help the customer", backstory="A support agent.",
    llm=llm,                               # your own CrewAI LLM
    skills=decimalai.crewai.skills(),      # the installed folder
    tools=decimalai.crewai.skill_tools(),  # reads a skill's files, runs its scripts
)
task = Task(description="Hello!", expected_output="an answer", agent=agent)
Crew(agents=[agent], tasks=[task]).kickoff()

The same install from Python, for a notebook or a setup script. CrewAI's own skill loader reads the installed folder. No DecimalAI account needed.

Install

pip install "decimalai>=0.16" "crewai>=1.15.27"

Add it to your agent

from decimalai import skillpkg

# Writes .agents/skills and .decimal/skills.toml. Safe to run twice.
result = skillpkg.add("ancoleman-architecting-security")
if result.exit_code:
    raise SystemExit(result.problems)

import decimalai.crewai
from crewai import Agent, Crew, Task

agent = Agent(
    role="Support", goal="Help the customer", backstory="A support agent.",
    llm=llm,                               # your own CrewAI LLM
    skills=decimalai.crewai.skills(),      # the installed folder
    tools=decimalai.crewai.skill_tools(),  # reads a skill's files, runs its scripts
)
task = Task(description="Hello!", expected_output="an answer", agent=agent)
Crew(agents=[agent], tasks=[task]).kickoff()

No DecimalAI package. CrewAI's own loader reads the folder, and nothing pins or updates it.

Copy SKILL.md

Save it in your project, as

.agents/skills/ancoleman-architecting-security/SKILL.md

Give it to your agent

from pathlib import Path
from crewai import Agent, Crew, Task

agent = Agent(
    role="Support", goal="Help the customer", backstory="A support agent.",
    llm=llm,                         # your own CrewAI LLM
    skills=[Path(".agents/skills")],
)
task = Task(description="Hello!", expected_output="an answer", agent=agent)
Crew(agents=[agent], tasks=[task]).kickoff()

This gets SKILL.md only. The skill's 13 other files are not included.

Other ways to add it

CrewAI docs

agent_config() hands your agent the skill. With no DecimalAI key it reads your project's files and sends nothing. Needs SDK 0.27 or newer.

Install

pip install "decimalai[adk]"
decimalai skills add ancoleman-architecting-security

Add it to your agent

from decimalai.adk import DecimalAIPlugin, agent_config
from google.adk.agents import LlmAgent
from google.adk.apps import App

# With no DECIMAL_API_KEY this reads the skills your project lists, from disk.
support = agent_config("support", fallback="You are a helpful agent.")

agent = LlmAgent(
    name="support",          # ADK needs a Python identifier
    model="gemini-3.5-flash",
    instruction=support.instruction,  # your prompt, then the skill list
    tools=[*support.tools],           # your tools, then load_skill
)
# DecimalAIPlugin makes each invocation of runners built from this App one trace.
app = App(name="support", root_agent=agent, plugins=[DecimalAIPlugin()])

Prefer ADK's own loader? SkillToolset(skills=decimalai.adk.skills(), ...) reads the same folder. Use one or the other: a skill delivered both ways reaches the prompt twice.

Install

pip install "decimalai[adk]"

Add it to your agent

from decimalai import skillpkg

# Writes .agents/skills and .decimal/skills.toml. Safe to run twice.
result = skillpkg.add("ancoleman-architecting-security")
if result.exit_code:
    raise SystemExit(result.problems)

from decimalai.adk import DecimalAIPlugin, agent_config
from google.adk.agents import LlmAgent
from google.adk.apps import App

# With no DECIMAL_API_KEY this reads the skills your project lists, from disk.
support = agent_config("support", fallback="You are a helpful agent.")

agent = LlmAgent(
    name="support",          # ADK needs a Python identifier
    model="gemini-3.5-flash",
    instruction=support.instruction,  # your prompt, then the skill list
    tools=[*support.tools],           # your tools, then load_skill
)
# DecimalAIPlugin makes each invocation of runners built from this App one trace.
app = App(name="support", root_agent=agent, plugins=[DecimalAIPlugin()])

Prefer ADK's own loader? SkillToolset(skills=decimalai.adk.skills(), ...) reads the same folder. Use one or the other: a skill delivered both ways reaches the prompt twice.

No DecimalAI package. The whole skill goes in every prompt, and nothing pins or updates it.

Copy SKILL.md

Save it in your project, as

.agents/skills/ancoleman-architecting-security/SKILL.md

Give it to your agent

from pathlib import Path
from google.adk.agents import LlmAgent

skill = Path(".agents/skills/ancoleman-architecting-security/SKILL.md").read_text()
agent = LlmAgent(
    name="support",
    model="gemini-3.5-flash",
    instruction=lambda context: f"You are a helpful agent.\n\n{skill}",
)

This gets SKILL.md only. The skill's 13 other files are not included.

Other ways to add it

Google ADK docs

agent_config() hands your agent the skill. With no DecimalAI key it reads your project's files and sends nothing. Needs SDK 0.27 or newer.

Install

pip install "decimalai[pydantic-ai]"
decimalai skills add ancoleman-architecting-security

Add it to your agent

from pydantic_ai import Agent
from decimalai.pydantic_ai import agent_config

# With no DECIMAL_API_KEY this reads the skills your project lists, from disk.
support = agent_config("support", fallback="You are a helpful agent.")

agent = Agent(
    "openai:gpt-4o-mini",
    name=support.name,
    tools=[],                 # your tools; the capability adds load_skill
    capabilities=[support],   # your prompt, the skill list and load_skill
)
# In a notebook or async code: result = await agent.run("Hello!")
result = agent.run_sync("Hello!")

On the Pydantic AI harness, decimalai.pydantic_ai_harness.skills(project) uses its own loader instead.

Install

pip install "decimalai[pydantic-ai]"

Add it to your agent

from decimalai import skillpkg

# Writes .agents/skills and .decimal/skills.toml. Safe to run twice.
result = skillpkg.add("ancoleman-architecting-security")
if result.exit_code:
    raise SystemExit(result.problems)

from pydantic_ai import Agent
from decimalai.pydantic_ai import agent_config

# With no DECIMAL_API_KEY this reads the skills your project lists, from disk.
support = agent_config("support", fallback="You are a helpful agent.")

agent = Agent(
    "openai:gpt-4o-mini",
    name=support.name,
    tools=[],                 # your tools; the capability adds load_skill
    capabilities=[support],   # your prompt, the skill list and load_skill
)
# In a notebook or async code: result = await agent.run("Hello!")
result = agent.run_sync("Hello!")

On the Pydantic AI harness, decimalai.pydantic_ai_harness.skills(project) uses its own loader instead.

No DecimalAI package. The whole skill goes in every prompt, and nothing pins or updates it.

Copy SKILL.md

Save it in your project, as

.agents/skills/ancoleman-architecting-security/SKILL.md

Give it to your agent

from pathlib import Path
from pydantic_ai import Agent

skill = Path(".agents/skills/ancoleman-architecting-security/SKILL.md").read_text()
agent = Agent("openai:gpt-4o-mini", instructions=f"You are a helpful agent.\n\n{skill}")
# In a notebook or async code: result = await agent.run("Hello!")
result = agent.run_sync("Hello!")

This gets SKILL.md only. The skill's 13 other files are not included.

Other ways to add it

Pydantic AI docs

Deep Agents' own skill loader reads the installed folder. No DecimalAI account needed.

Install

pip install "decimalai>=0.16" deepagents
decimalai skills add ancoleman-architecting-security

Add it to your agent

import decimalai.deepagents
from deepagents import create_deep_agent

agent = create_deep_agent(model=model, **decimalai.deepagents.skills())
agent.invoke({"messages": [{"role": "user", "content": "Hello!"}]})

The default backend reads files but has no shell. To run a skill's scripts, pass skills(backend=LocalShellBackend(...)).

The same install from Python, for a notebook or a setup script. Deep Agents' own skill loader reads the installed folder. No DecimalAI account needed.

Install

pip install "decimalai>=0.16" deepagents

Add it to your agent

from decimalai import skillpkg

# Writes .agents/skills and .decimal/skills.toml. Safe to run twice.
result = skillpkg.add("ancoleman-architecting-security")
if result.exit_code:
    raise SystemExit(result.problems)

import decimalai.deepagents
from deepagents import create_deep_agent

agent = create_deep_agent(model=model, **decimalai.deepagents.skills())
agent.invoke({"messages": [{"role": "user", "content": "Hello!"}]})

The default backend reads files but has no shell. To run a skill's scripts, pass skills(backend=LocalShellBackend(...)).

No DecimalAI package. The whole skill goes in every prompt, and nothing pins or updates it.

Copy SKILL.md

Save it in your project, as

.agents/skills/ancoleman-architecting-security/SKILL.md

Give it to your agent

from pathlib import Path
from deepagents import create_deep_agent

skill = Path(".agents/skills/ancoleman-architecting-security/SKILL.md").read_text()
agent = create_deep_agent(model=model, system_prompt=f"You are a helpful agent.\n\n{skill}")
agent.invoke({"messages": [{"role": "user", "content": "Hello!"}]})

This gets SKILL.md only. The skill's 13 other files are not included.

Other ways to add it

Deep Agents docs

Its own skill loader reads the installed folder. No DecimalAI account needed.

Install

pip install "decimalai>=0.16" agent-framework
decimalai skills add ancoleman-architecting-security

Add it to your agent

import asyncio

from agent_framework import Agent
from decimalai.agent_framework import skills

agent = Agent(client=client, instructions="You are a helpful agent.", context_providers=[skills()])
asyncio.run(agent.run("Hello!"))

It caches skills by default, so restart the process after decimalai skills update.

The same install from Python, for a notebook or a setup script. Its own skill loader reads the installed folder. No DecimalAI account needed.

Install

pip install "decimalai>=0.16" agent-framework

Add it to your agent

from decimalai import skillpkg

# Writes .agents/skills and .decimal/skills.toml. Safe to run twice.
result = skillpkg.add("ancoleman-architecting-security")
if result.exit_code:
    raise SystemExit(result.problems)

import asyncio

from agent_framework import Agent
from decimalai.agent_framework import skills

agent = Agent(client=client, instructions="You are a helpful agent.", context_providers=[skills()])
asyncio.run(agent.run("Hello!"))

It caches skills by default, so restart the process after decimalai skills update.

No DecimalAI package. The whole skill goes in every prompt, and nothing pins or updates it.

Copy SKILL.md

Save it in your project, as

.agents/skills/ancoleman-architecting-security/SKILL.md

Give it to your agent

import asyncio
from pathlib import Path
from agent_framework import Agent

skill = Path(".agents/skills/ancoleman-architecting-security/SKILL.md").read_text()
agent = Agent(client=client, instructions=f"You are a helpful agent.\n\n{skill}")
asyncio.run(agent.run("Hello!"))

This gets SKILL.md only. The skill's 13 other files are not included.

Other ways to add it

Microsoft Agent Framework docs

Strands' own skill loader reads the installed folder. No DecimalAI account needed.

Install

pip install "decimalai>=0.16" strands-agents
decimalai skills add ancoleman-architecting-security

Add it to your agent

from decimalai.strands import skills
from strands import Agent
from strands.vended_tools import file_editor, shell

agent = Agent(
    model=model,                # always pass one: the default is Amazon Bedrock
    system_prompt="You are a helpful agent.",
    tools=[file_editor, shell],
    plugins=[skills()],
)
agent("Hello!")

Strands loads an agent's skills once, so build the agent again after decimalai skills update.

The same install from Python, for a notebook or a setup script. Strands' own skill loader reads the installed folder. No DecimalAI account needed.

Install

pip install "decimalai>=0.16" strands-agents

Add it to your agent

from decimalai import skillpkg

# Writes .agents/skills and .decimal/skills.toml. Safe to run twice.
result = skillpkg.add("ancoleman-architecting-security")
if result.exit_code:
    raise SystemExit(result.problems)

from decimalai.strands import skills
from strands import Agent
from strands.vended_tools import file_editor, shell

agent = Agent(
    model=model,                # always pass one: the default is Amazon Bedrock
    system_prompt="You are a helpful agent.",
    tools=[file_editor, shell],
    plugins=[skills()],
)
agent("Hello!")

Strands loads an agent's skills once, so build the agent again after decimalai skills update.

No DecimalAI package. The whole skill goes in every prompt, and nothing pins or updates it.

Copy SKILL.md

Save it in your project, as

.agents/skills/ancoleman-architecting-security/SKILL.md

Give it to your agent

from pathlib import Path
from strands import Agent

skill = Path(".agents/skills/ancoleman-architecting-security/SKILL.md").read_text()
agent = Agent(model=model, system_prompt=f"You are a helpful agent.\n\n{skill}")
agent("Hello!")

This gets SKILL.md only. The skill's 13 other files are not included.

Other ways to add it

Strands docs

Adds every file the skill has, pinned so you can update it. Cursor, Copilot, Cline and Warp read this folder by themselves.

pip install "decimalai>=0.15"
decimalai skills add ancoleman-architecting-security

No Python or account. Cursor, Copilot, Cline and Warp read this folder by themselves.

Save it into your project

curl -fsSL --create-dirs -o .agents/skills/ancoleman-architecting-security/SKILL.md https://app.decimal.ai/s/ancoleman-architecting-security/SKILL.md

Copy SKILL.md

Save it in your project, as

.agents/skills/ancoleman-architecting-security/SKILL.md

This gets SKILL.md only. The skill's 13 other files are not included.

Other ways to add it

Cursor and other editors docs

Fetch the file and give its text to your model as instructions. No account or package needed.

Get the file

curl -fsSL https://app.decimal.ai/s/ancoleman-architecting-security/SKILL.md

Read the summary as JSON

curl -fsSL https://app.decimal.ai/s/ancoleman-architecting-security.json

This gets SKILL.md only. The skill's 13 other files are not included.

Other ways to add it

Other setups docs

You don't need a DecimalAI account.

Version: v1, tested 8/21/2026
Source: ancoleman/ai-design-components ↗
License: MIT

Manage it in DecimalAI

Saved prompts and skills, pinned versions, and traces of this skill in your runs. DecimalAI does not run your agent.

Claude Code reads files from your project, so DecimalAI config does not apply there.

On Claude Agent SDK: save the skill to an agent here, set DECIMAL_API_KEY, and the same code uses it with no command to run. Changes you save reach the next run with no redeploy.

On OpenAI Agents: save the skill to an agent here, set DECIMAL_API_KEY, and the same code uses it with no command to run. Changes you save reach the next run with no redeploy.

On OpenAI SDK: save the skill to an agent here, set DECIMAL_API_KEY, and the same code uses it with no command to run. Changes you save reach the next run with no redeploy.

On Anthropic: save the skill to an agent here, set DECIMAL_API_KEY, and the same code uses it with no command to run. Changes you save reach the next run with no redeploy.

On Gemini API: save the skill to an agent here, set DECIMAL_API_KEY, and the same code uses it with no command to run. Changes you save reach the next run with no redeploy.

On LangChain: save the skill to an agent here, set DECIMAL_API_KEY, and the same code uses it with no command to run. Changes you save reach the next run with no redeploy.

On CrewAI: set DECIMAL_API_KEY and add decimalai.init(crewai=True) to record runs and skill use. The skill version stays in your repo.

On Google ADK: save the skill to an agent here, set DECIMAL_API_KEY, and the same code uses it with no command to run. Changes you save reach the next run with no redeploy.

On Pydantic AI: save the skill to an agent here, set DECIMAL_API_KEY, and the same code uses it with no command to run. Changes you save reach the next run with no redeploy.

On Deep Agents: set DECIMAL_API_KEY and add decimalai.init(langchain=True) to record runs and skill use. The skill version stays in your repo.

On Microsoft Agent Framework: set DECIMAL_API_KEY and add decimalai.init(otel=True, agent_name="support") to record runs and skill use. The skill version stays in your repo.

On Strands: set DECIMAL_API_KEY and add decimalai.init(otel=True, agent_name="support") to record runs and skill use. The skill version stays in your repo.

Editors read files from your project, so DecimalAI config does not apply there.

Anywhere else: record a use with decimalai.log_skill_activation() inside a trace.

Use this skill

SKILL.md

Security Architecture

Design and implement comprehensive security architectures that protect systems, data, and users through layered defense strategies, zero trust principles, and risk-based security controls.

Purpose

Security architecture provides the strategic foundation for building resilient, compliant, and trustworthy systems. This skill guides the design of defense-in-depth layers, zero trust implementations, threat modeling methodologies, and mapping to control frameworks (NIST CSF, CIS Controls, ISO 27001).

Unlike tactical security skills (configuring firewalls, implementing authentication, scanning vulnerabilities), security architecture focuses on strategic planning, comprehensive defense strategies, and governance frameworks.

When to Use This Skill

Use security architecture when:

Designing security for greenfield systems (new applications, cloud migrations)
Conducting security audits or risk assessments of existing systems
Implementing zero trust architecture across enterprise environments
Establishing security governance programs and compliance frameworks
Threat modeling applications, APIs, or microservices architectures
Selecting and mapping security controls to regulatory requirements (SOC 2, HIPAA, PCI DSS)
Designing cloud security architectures (AWS, GCP, Azure multi-account strategies)
Addressing supply chain security (SLSA framework, SBOM implementation)

Core Security Architecture Principles

1. Defense in Depth

Implement multiple independent layers of security controls so that if one layer fails, others continue to protect critical assets.

9 Defense Layers (2025 Model):

Physical Security: Data center access, environmental controls, hardware security modules (HSMs)
Network Perimeter: Next-gen firewalls (NGFW), DDoS protection, web application firewalls (WAF)
Network Segmentation: VLANs, VPCs, security groups, micro-segmentation
Endpoint Protection: EDR, antivirus, device encryption, patch management
Application Layer: Secure coding, WAF, API security, SAST/DAST scanning
Data Layer: Encryption (at-rest, in-transit, in-use), DLP, backup/recovery
Identity & Access Management: MFA, SSO, RBAC/ABAC, privileged access management (PAM)
Behavioral Analytics: UEBA, ML-based anomaly detection, threat intelligence
Security Operations: SIEM, SOAR, incident response, continuous monitoring

Key Principle: Each layer provides independent protection. Failure of one layer does not compromise the entire system.

For detailed layer-by-layer implementation patterns, see references/defense-in-depth.md.

2. Zero Trust Architecture

Implement "never trust, always verify" principles where every access request is authenticated, authorized, and continuously validated.

Core Zero Trust Principles:

Continuous Verification: Authenticate and authorize every access request (no implicit trust)
Least Privilege Access: Grant minimal permissions required, use just-in-time (JIT) access
Assume Breach: Design systems expecting compromise, limit blast radius
Explicit Verification: Verify user identity (MFA), device health, application integrity, context (location, time, behavior)
Micro-Segmentation: Divide networks into small isolated zones, control east-west traffic

Zero Trust Architecture Components:

Policy Engine: Centralized authorization decision point (allow/deny)
Identity Provider (IdP): User/machine identity verification (Azure AD, Okta)
Device Posture Service: Device health checks (MDM, EDR integration)
Context/Risk Engine: Behavioral analytics, location, time, threat intelligence
Policy Enforcement Points: Gateways enforcing decisions (ZTNA, API gateways)

For zero trust implementation roadmap and reference architecture, see references/zero-trust-architecture.md.

3. Threat Modeling

Systematically identify, prioritize, and mitigate security threats through structured methodologies.

Primary Methodologies:

Methodology	Purpose	Complexity	Best For
STRIDE	Threat identification	Low	Development teams, quick threat analysis
PASTA	Risk-centric analysis	High	Enterprise risk management
DREAD	Risk scoring	Low	Prioritizing existing threats
Attack Trees	Visual threat analysis	Medium	Security architecture reviews

STRIDE Threat Categories:

Spoofing: Attacker impersonates another user/system (Mitigation: MFA, certificate validation)
Tampering: Unauthorized data modification (Mitigation: Encryption, digital signatures)
Repudiation: User denies action without proof (Mitigation: Audit logs, non-repudiation)
Information Disclosure: Confidential data exposure (Mitigation: Encryption, access controls, DLP)
Denial of Service: System unavailability (Mitigation: Rate limiting, DDoS protection, redundancy)
Elevation of Privilege: Gaining higher privileges (Mitigation: Least privilege, input validation, patching)

STRIDE Application Process:

Model the system using data flow diagrams (DFDs)
Identify threats by applying STRIDE to each component/data flow
Document threats with STRIDE categories
Prioritize threats using DREAD scoring or business impact
Design mitigation controls

For detailed threat modeling methodologies, PASTA process, DREAD scoring, and attack trees, see references/threat-modeling.md. For threat modeling examples, see examples/threat-models/.

Security Control Frameworks

Map security controls to industry frameworks to ensure comprehensive coverage and compliance.

NIST Cybersecurity Framework (CSF) 2.0

6 Core Functions:

GOVERN (GV): Risk management strategy, policies, supply chain risk management
IDENTIFY (ID): Asset inventory, risk assessment, continuous improvement
PROTECT (PR): Access control, data security, platform security, infrastructure resilience
DETECT (DE): Continuous monitoring, anomaly detection, security event analysis
RESPOND (RS): Incident management, analysis, communication, mitigation
RECOVER (RC): Recovery planning, execution, post-incident improvement

Usage: Map security controls to NIST CSF categories to ensure coverage of all security functions. Provides risk-based, flexible framework for security programs.

For detailed NIST CSF category mapping and subcategories, see references/nist-csf-mapping.md.

CIS Critical Security Controls v8

18 Controls organized in 3 Implementation Groups:

IG1 (Basic): 56 safeguards for small organizations (asset inventory, access control, logging, backups)
IG2 (Intermediate): +74 safeguards for mid-sized organizations with IT security staff
IG3 (Advanced): +23 safeguards for large enterprises with dedicated security teams

Top Priority Controls (IG1):

Inventory and Control of Enterprise Assets
Inventory and Control of Software Assets
Data Protection
Secure Configuration of Enterprise Assets
Account Management
Access Control Management
Continuous Vulnerability Management
Audit Log Management

Usage: CIS Controls provide prescriptive, measurable security baseline. Start with IG1, progress to IG2/IG3 as security maturity increases.

For detailed CIS Controls implementation guidance, see references/cis-controls.md.

OWASP Top 10 Risk Mitigation

Map OWASP Top 10 application security risks to architectural controls:

OWASP Risk	Primary Control	Framework Mapping
Injection	Parameterized queries, input validation	NIST PR.DS, CIS 16
Broken Authentication	MFA, secure session management	NIST PR.AC, CIS 5, 6
Sensitive Data Exposure	Encryption, key management	NIST PR.DS, CIS 3
XXE	Disable external entities, use JSON	NIST PR.DS, CIS 16
Broken Access Control	Authorization checks, RBAC	NIST PR.AC, CIS 6
Security Misconfiguration	Hardening, minimal configs	NIST PR.IP, CIS 4
XSS	Output encoding, CSP	NIST PR.DS, CIS 16
Insecure Deserialization	Validate objects, safe formats	NIST PR.DS, CIS 16
Known Vulnerabilities	Patch management, SBOM	NIST ID.RA, CIS 7
Logging & Monitoring	SIEM, centralized logging	NIST DE.CM, CIS 8

For detailed OWASP Top 10 mitigation strategies and code examples, see references/owasp-top10-mitigation.md.

Architecture Selection Decision Framework

Select appropriate security architecture approach based on system characteristics:

Greenfield (New System):

Implement Zero Trust from Day 1
Identity-first architecture (MFA, SSO, RBAC/ABAC)
Micro-segmentation by default
Assume breach mentality (limit blast radius)
Continuous verification and monitoring

Brownfield (Existing System):

Hybrid: Maintain Defense in Depth + Zero Trust overlay
Keep existing perimeter controls (firewalls, VPN)
Layer Zero Trust controls progressively
Segment critical assets first (data, admin access)
Modernize identity and access management

Compliance-Driven:

Map to control frameworks based on requirements:
- General Security: NIST CSF for risk-based approach
- Baseline Hardening: CIS Controls for prescriptive guidance
- Comprehensive ISMS: ISO 27001 for certification
- Industry-Specific: PCI DSS (payments), HIPAA Security Rule (healthcare), FedRAMP (government)

Cloud-Native:

Use cloud provider reference architectures:
- AWS: Well-Architected Framework (Security Pillar)
- GCP: Security Best Practices, Security Command Center
- Azure: Security Benchmark, Defender for Cloud
Implement cloud-native security services (CSPM, CWPP)

Hybrid/Multi-Cloud:

Cloud Security Posture Management (CSPM) for unified policy enforcement
Cross-cloud visibility and monitoring
Cloud-agnostic IAM (Okta, Azure AD)

For detailed architecture selection decision trees, see references/defense-in-depth.md and references/zero-trust-architecture.md.

Supply Chain Security

Protect software supply chain from tampering, backdoors, and compromised dependencies.

SLSA Framework

Supply-chain Levels for Software Artifacts (4 levels):

SLSA Level 1 - Provenance: Build process generates provenance metadata (not tamper-proof)
SLSA Level 2 - Hosted Build: Build on trusted platform (GitHub Actions, Cloud Build)
SLSA Level 3 - Hardened Build: Build platform prevents tampering, audit logs
SLSA Level 4 - Hermetic, Reproducible: Fully hermetic builds, reproducible, two-party review

Implementation: Start with Level 1 provenance generation, progress to Level 2 (GitHub Actions), then Level 3 (hardened CI/CD with audit logs).

SBOM (Software Bill of Materials)

Generate and maintain inventory of software components and dependencies.

SBOM Standards:

CycloneDX: OWASP standard (JSON/XML format)
SPDX: Linux Foundation standard
SWID: ISO/IEC 19770-2 standard

SBOM Use Cases:

Vulnerability Management: Quickly identify affected components during CVE disclosures
License Compliance: Track open-source licenses for legal compliance
Supply Chain Risk: Visibility into third-party code and dependencies
Incident Response: Rapid assessment of Log4Shell-type incidents

Dependency Management Best Practices:

Generate SBOM automatically in CI/CD pipeline
Continuous scanning with tools (Dependabot, Snyk, Trivy, Grype)
Automated security patch updates
License compliance tracking and approval workflows
Pin dependency versions using lock files
Minimize dependencies to reduce attack surface

For SLSA implementation guide, SBOM generation examples, and dependency scanning automation, see references/supply-chain-security.md.

Cloud Security Architecture Patterns

AWS Security Architecture

Well-Architected Framework - Security Pillar Principles:

Strong identity foundation: Centralize IAM, least privilege, IAM Identity Center (SSO)
Enable traceability: CloudTrail, GuardDuty, Security Hub for comprehensive logging
Apply security at all layers: Defense in depth across VPC, instances, applications, data
Automate security best practices: Infrastructure as Code (Terraform, CloudFormation)
Protect data in transit and at rest: TLS 1.3, AWS KMS, encryption everywhere

Key AWS Security Services:

IAM: AWS IAM, IAM Identity Center (SSO), Cognito (customer identity)
Detection: GuardDuty (threat detection), Security Hub (centralized findings), Detective (investigation)
Network: AWS WAF, Shield (DDoS), Network Firewall
Data: KMS (key management), Secrets Manager, Macie (data classification)
Compute: Systems Manager (patch management), Inspector (vulnerability scanning)

Multi-Account Strategy: Use AWS Organizations with Security OU (Security Account, Logging Account, Audit Account) and Workload OUs (Production, Non-Production). Apply Service Control Policies (SCPs) for guardrails.

For AWS reference architectures and multi-account security setup, see references/aws-security-architecture.md and examples/architectures/aws-multi-account-security.md.

GCP Security Architecture

Key GCP Security Services:

IAM: Cloud IAM, Identity Platform (customer identity), Cloud Identity (workforce)
Detection: Security Command Center (unified dashboard), Chronicle (SIEM), Event Threat Detection
Network: Cloud Armor (DDoS/WAF), VPC Service Controls (data exfiltration prevention), Cloud Firewall
Data: Cloud KMS, Secret Manager, Cloud DLP (data loss prevention)
Compute: Binary Authorization (image signing), Confidential Computing (encryption in use)

Organization Hierarchy: Structure with Organization → Folders (Production, Non-Production, Security) → Projects. Apply IAM policies at folder level for inheritance.

For GCP security architecture patterns and organization setup, see references/gcp-security-architecture.md and examples/architectures/gcp-security-hierarchy.md.

Azure Security Architecture

Key Azure Security Services:

IAM: Azure AD (Entra ID), Privileged Identity Management (JIT access), Conditional Access
Detection: Microsoft Defender for Cloud (CSPM/CWPP), Sentinel (SIEM/SOAR), Azure Monitor
Network: Azure Firewall, Front Door + WAF, DDoS Protection
Data: Key Vault (secrets, keys, certificates), Information Protection (DLP), Storage encryption
Compute: Just-in-Time VM Access, Azure Policy (compliance enforcement)

Hub-Spoke Landing Zone: Implement hub VNet (shared services: firewall, VPN, Azure Bastion) with spoke VNets (workloads). Use Management Groups for policy hierarchy.

For Azure security architecture and hub-spoke design, see references/azure-security-architecture.md and examples/architectures/azure-landing-zone.md.

Identity & Access Management Patterns

Authentication Controls

Multi-Factor Authentication (MFA):

Types: TOTP (time-based one-time passwords), push notifications, biometrics, hardware tokens (YubiKey, FIDO2)
Enforcement: Require MFA for all users (workforce and customers), especially privileged accounts
Passwordless: Transition to WebAuthn, FIDO2, passkeys to eliminate password-based attacks

Single Sign-On (SSO):

Protocols: SAML 2.0, OAuth 2.0, OpenID Connect (OIDC)
Benefits: Centralized authentication, reduced password fatigue, improved security posture
Implementation: Azure AD, Okta, Auth0, Ping Identity

Authorization Controls

Role-Based Access Control (RBAC):

Users assigned to roles, roles have permissions
Coarse-grained, simple to implement
Best for: Organizations with stable role structures

Attribute-Based Access Control (ABAC):

Fine-grained access based on attributes (user department, resource classification, time, location)
More flexible than RBAC
Best for: Complex, dynamic access requirements

Policy-Based Access Control (PBAC):

Centralized policy engines (Open Policy Agent - OPA, AWS Cedar)
Policies defined declaratively and versioned
Best for: Microservices, API gateways, cloud-native architectures

Privileged Access Management (PAM)

Just-in-Time (JIT) Access:

Temporary elevated privileges for specific tasks
Time-bound access grants (e.g., 4 hours)
Reduces standing privileged access

Credential Vaulting:

Centralized storage of privileged credentials (CyberArk, HashiCorp Vault, Azure Key Vault)
Automatic password rotation
Session recording and auditing

For detailed IAM implementation patterns, MFA configuration, and PAM setup, see references/iam-patterns.md.

Security Monitoring & Operations

SIEM (Security Information & Event Management)

Centralize log aggregation, correlation, and alerting for security events.

Leading SIEM Platforms:

Splunk, Elastic Security, Microsoft Sentinel, Chronicle

SIEM Architecture:

Log Collection: Ingest logs from all layers (network, endpoints, applications, cloud)
Normalization: Standardize log formats for correlation
Correlation: Apply rules to detect patterns (failed logins → brute force attack)
Alerting: Notify SOC team of high-priority events
Investigation: Provide search and visualization for incident analysis

SOAR (Security Orchestration, Automation & Response)

Automate incident response workflows to reduce mean time to respond (MTTR).

SOAR Capabilities:

Playbooks: Automated response workflows (block IP, quarantine endpoint, revoke credentials)
Orchestration: Integrate with security tools (SIEM, EDR, firewall, IAM)
Case Management: Track incidents, assign to analysts, document resolution

Leading SOAR Platforms:

Splunk SOAR, Palo Alto Cortex XSOAR, IBM Resilient

Detection Strategies

UEBA (User & Entity Behavior Analytics):

Machine learning-based anomaly detection
Detects: Account compromise, insider threats, data exfiltration
Baseline normal behavior, alert on deviations

Threat Intelligence:

Integrate threat feeds (MISP, ThreatConnect, ISACs)
Enrich alerts with threat context (known malicious IPs, IOCs)
Proactive threat hunting using TTPs (MITRE ATT&CK framework)

For SIEM architecture, SOAR playbook examples, and detection strategies, see references/security-operations.md.

Quick Reference: Control Framework Mapping

Use this table to map risks to appropriate control frameworks:

Risk/Requirement	Framework	Key Controls
General security program	NIST CSF 2.0	All 6 functions (GV, ID, PR, DE, RS, RC)
Compliance baseline	CIS Controls v8	IG1: Controls 1-18 (56 safeguards)
ISO certification	ISO 27001/27002	114 controls across 14 domains
Application security	OWASP ASVS	286 security requirements (3 levels)
Cloud security (AWS)	AWS Well-Architected	Security Pillar: 10 design principles
Cloud security (GCP)	GCP Security Best Practices	Security Command Center architecture
Cloud security (Azure)	Azure Security Benchmark	Defender for Cloud controls
Supply chain security	SLSA + SBOM	Level 2+ SLSA, CycloneDX SBOM
Zero trust architecture	NIST SP 800-207	ZTA tenets, deployment models
Privacy/GDPR	NIST Privacy Framework	Privacy engineering objectives

Integration with Related Skills

Security architecture provides the strategic foundation for tactical security implementations:

infrastructure-as-code: Implement security architecture as code (secure defaults, hardening)
kubernetes-operations: Apply K8s security architecture (RBAC, Pod Security, Network Policies)
secret-management: Architect secrets management (KMS, Vault, rotation strategies)
building-ci-pipelines: Secure CI/CD architecture (SAST/DAST integration, artifact signing)
configuring-firewalls: Implement network perimeter layer of defense-in-depth
vulnerability-management: Integrate vulnerability scanning into security architecture
auth-security: Implement IAM layer details (MFA, RBAC/ABAC, session management)
siem-logging: Implement security monitoring architecture (SIEM, log aggregation)
compliance-frameworks: Map security architecture to compliance requirements

Common Security Architecture Patterns

Pattern 1: Zero Trust Network Access (ZTNA)

Replace VPN with identity-based access to applications.

Architecture:

User authenticates to identity provider (Azure AD, Okta)
Device posture check validates device health
Policy engine evaluates access request (user, device, context)
Access granted through secure connector (no network access)

Benefits: Eliminates lateral movement, reduces attack surface, improves user experience

Pattern 2: Defense in Depth for Web Applications

Layer multiple security controls for web application protection.

Layers:

DDoS Protection (Cloudflare, AWS Shield)
WAF (application firewall, OWASP Top 10 rules)
API Gateway (authentication, rate limiting)
Application Security (SAST/DAST, secure coding)
Database Security (encryption, least privilege)
Logging & Monitoring (SIEM, anomaly detection)

Pattern 3: Cloud Security Posture Management (CSPM)

Continuously monitor and enforce security configurations across cloud environments.

Architecture:

Asset Discovery: Inventory all cloud resources
Configuration Assessment: Compare against security baselines (CIS Benchmarks)
Compliance Monitoring: Track regulatory compliance (SOC 2, ISO 27001)
Remediation: Automated fixes or guided workflows
Drift Detection: Alert on configuration changes

Leading CSPM Tools: Wiz, Orca Security, Prisma Cloud, Microsoft Defender for Cloud

Resources and References

Defense in Depth:

references/defense-in-depth.md - 9-layer defense model, implementation patterns, failure impact analysis

Zero Trust Architecture:

references/zero-trust-architecture.md - ZTA principles, reference architecture, implementation roadmap

Threat Modeling:

references/threat-modeling.md - STRIDE, PASTA, DREAD, Attack Trees methodologies
examples/threat-models/web-app-stride.md - Web application STRIDE analysis example
examples/threat-models/api-threat-model.md - REST API threat model example
examples/threat-models/microservices-threat-model.md - Microservices threat model example

Control Frameworks:

references/nist-csf-mapping.md - NIST CSF 2.0 functions, categories, subcategories
references/cis-controls.md - CIS Controls v8, implementation groups, safeguards
references/owasp-top10-mitigation.md - OWASP Top 10 risks and mitigation strategies

Supply Chain Security:

references/supply-chain-security.md - SLSA framework, SBOM generation, dependency scanning

Cloud Security:

references/aws-security-architecture.md - AWS Well-Architected Security Pillar, services, patterns
references/gcp-security-architecture.md - GCP Security Best Practices, services, organization design
references/azure-security-architecture.md - Azure Security Benchmark, Defender for Cloud, landing zones

IAM & Operations:

references/iam-patterns.md - Authentication, authorization, MFA, RBAC/ABAC, PAM
references/security-operations.md - SIEM, SOAR, UEBA, threat intelligence, incident response

Architecture Examples:

examples/architectures/aws-multi-account-security.md - AWS Organizations security setup
examples/architectures/gcp-security-hierarchy.md - GCP folder/project security hierarchy
examples/architectures/azure-landing-zone.md - Azure hub-spoke landing zone
examples/architectures/zero-trust-network.md - Zero trust network design

Scripts:

scripts/threat-model-template.py - Generate STRIDE threat model templates
scripts/control-gap-analysis.sh - Compare current controls against frameworks
scripts/sbom-generate.sh - Generate SBOM in CycloneDX format
scripts/security-checklist.sh - Automated security architecture checklist

Summary

Security architecture requires strategic planning across multiple layers, from physical security to security operations. Implement defense-in-depth for comprehensive protection, adopt zero trust principles for modern cloud environments, use threat modeling to identify risks proactively, and map controls to frameworks for compliance and completeness.

Start with risk assessment to understand threats, select appropriate architecture approach (zero trust for greenfield, hybrid for brownfield), implement layered controls, and continuously monitor and improve security posture.

When it activates

Automatically, when a task matches. Use when designing security for new systems, auditing existing architectures, or establishing security governance programs.

About this skill

Automatic

Security & AppSec pack

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/3/2026

View 15 scanner checks

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

ancoleman / ai-design-components

skills/architecting-security/SKILL.md

View on GitHub ↗

License MITImported 8/3/2026Version v1Bundled 13 files · scripts

Illustrative Want to see what ancoleman/architecting-security would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Other skills for the same job

Published skills whose descriptions closely match this one, with their headline benchmark lift.

aiskillstore/security-engineeringSecurity architecture and implementation patterns. Use when designing security controls, implementing authentication/authorization, conducting threat modeling, or ensuring compliance with security frameworks.Close match0 pts pass-rate lift

Related skills

Skills that do similar work, with their headline benchmark lift.

From the same source and nearby in the catalogue.

Ready to supercharge your AI agents?

SkillScore

Safety

What it changes

Track record

Use this skill

Security Architecture

Purpose

When to Use This Skill

Core Security Architecture Principles

1. Defense in Depth

2. Zero Trust Architecture

3. Threat Modeling

Security Control Frameworks

NIST Cybersecurity Framework (CSF) 2.0

CIS Critical Security Controls v8

OWASP Top 10 Risk Mitigation

Architecture Selection Decision Framework

Supply Chain Security

SLSA Framework

SBOM (Software Bill of Materials)

Cloud Security Architecture Patterns

AWS Security Architecture

GCP Security Architecture

Azure Security Architecture

Identity & Access Management Patterns

Authentication Controls

Authorization Controls

Privileged Access Management (PAM)

Security Monitoring & Operations

SIEM (Security Information & Event Management)

SOAR (Security Orchestration, Automation & Response)

Detection Strategies

Quick Reference: Control Framework Mapping

Integration with Related Skills

Common Security Architecture Patterns

Pattern 1: Zero Trust Network Access (ZTNA)

Pattern 2: Defense in Depth for Web Applications

Pattern 3: Cloud Security Posture Management (CSPM)

Resources and References

Summary

When it activates

SkillSafety

Source

Other skills for the same job

Related skills

More in the registry