# LAKA Volumetric Security Grammar

> A defensive, authorization-first security grammar: the SECURITY_UNIT model, a volumetric matrix of variables × meta-variables × five change levels, hardening grammars for drives, VPS hosts, web applications and containers, plus schemas, worked examples, a deny-first policy and a machine-checkable authorization gate.

Version 1.0.0, reviewed 2026-09-03. 15 chapters, 8 JSON Schemas, 7 worked examples, 16 SECURITY_UNIT components, 10 internal variables × 14 meta-variables × 5 change levels, 9 deny rules, 10 adopted standards.

Boundaries: A specification and reference set — not an attack tool, a scanner, a certification or a completed assessment. It does not automate exploitation. Active or state-changing operations require a valid authorization manifest, an in-scope target, an allowed mode, verified preconditions and verified rollback.

## API
Base URL: https://security.bowtiekreative.com
OpenAPI: https://security.bowtiekreative.com/v1/openapi.json
Index: https://security.bowtiekreative.com/v1

Read:
- https://security.bowtiekreative.com/v1 — This index
- https://security.bowtiekreative.com/v1/health — Liveness and corpus counts
- https://security.bowtiekreative.com/v1/openapi.json — OpenAPI 3.1 description of this API
- https://security.bowtiekreative.com/v1/manifest — Package manifest, inventory and boundaries
- https://security.bowtiekreative.com/v1/unit — The SECURITY_UNIT model and the governing production rule
- https://security.bowtiekreative.com/v1/matrix — The volumetric matrix: variables, meta-variables and five change levels
- https://security.bowtiekreative.com/v1/schemas — The eight JSON Schemas, listed
- https://security.bowtiekreative.com/v1/schemas/{name} — One schema in full, e.g. finding
- https://security.bowtiekreative.com/v1/deny-rules — The deny-first policy rules
- https://security.bowtiekreative.com/v1/standards — The adopted, version-pinned standards register
- https://security.bowtiekreative.com/v1/tools — Registered tool classes — names and safety posture only
- https://security.bowtiekreative.com/v1/examples — The worked example documents, listed
- https://security.bowtiekreative.com/v1/examples/{id} — One example: JSON document plus YAML original
- https://security.bowtiekreative.com/v1/docs — The fifteen chapters, listed
- https://security.bowtiekreative.com/v1/docs/{slug} — One chapter, as markdown
- https://security.bowtiekreative.com/v1/sources — Standards and chapter sources

Decide:
- POST https://security.bowtiekreative.com/v1/validate — check {schema, document} against one of the 8 published schemas. Structural validity only.
- POST https://security.bowtiekreative.com/v1/authorize-check — evaluate the governing authorization rule; missing gates count as false and the default is deny. A decision function only; it never executes, scans or changes anything.

## Pages
- https://security.bowtiekreative.com/grammar — Security grammar: The SECURITY_UNIT sentence and its production rules
- https://security.bowtiekreative.com/matrix — Volumetric matrix: 10 variables × 14 meta-variables × 5 change levels
- https://security.bowtiekreative.com/graph — Threat & control graph: Attack paths, control links and evidence as a graph
- https://security.bowtiekreative.com/domains — Hardening domains: Drives, VPS hosts, web applications, containers
- https://security.bowtiekreative.com/operations — Operations: Monitoring, incident response, risk prioritization
- https://security.bowtiekreative.com/command-language — Command language: The CLI and agent command grammar
- https://security.bowtiekreative.com/operating-model — Operating model: Client boundaries, reporting and the roadmap
- https://security.bowtiekreative.com/standards — Standards: 10 adopted standards, version-pinned
- https://security.bowtiekreative.com/examples — Worked examples: 7 schema-conformant YAML documents
- https://security.bowtiekreative.com/schemas — JSON Schemas: 8 document schemas, browsable
- https://security.bowtiekreative.com/api — API reference: Every endpoint, with examples

## Usage note
This grammar is defensive and authorization-first. It documents how to describe, gate and evidence security work — it does not automate exploitation, and no endpoint here performs scanning, testing or change. Active operations in the real world require a valid authorization manifest, an in-scope target, an allowed mode, verified preconditions and verified rollback.