Guard
The controls
access
Identity, sign-on, the role ladder, and the owner/shared line.
hardening
Shrinking the attack surface, before anything goes wrong.
secrets
Credentials and keys, kept out of reach.
recovery
Backups and restore — being able to come back.
air-lock
The one gated path into the sealed range and practice forks.
safety
hardening & recovery
In a nutshell
Every other layer describes what exists and how it connects; this one governs it. Guard answers two questions: who is allowed in, and how the enclave stays safe once they are. The first is identity — directories, sign-on, and the split between the real-identity workplace and the volunteer commons. The second is protection — hardening the surfaces that face attack, keeping secrets out of reach, and being able to recover when something fails. And where a space must stay sealed off entirely, the Air-Lock is the one gated path through it — controlled access made literal. The tools doing this work are catalogued in Software; here it’s the policy — the rules, not the packages.