Security Model

VCP is designed around explicit privacy boundaries. This page explains the current controls, their evidence limits, and the responsibilities of each receiving implementation.

Core Security Principles

Data Minimization

VCP is designed to transmit the minimum needed. Private details become boolean flags — platforms see budget_limited: true, not your financial situation.

User Control

You decide what's shared with whom. Consent is explicit and revocable. Compatible flows require permission before sensitive data is shared.

Full Auditability

Sharing events are designed to be logged so you can see what was shared, when, and with which platform.

Privacy Levels

Every piece of context in VCP has a privacy level that determines how it can be shared.

Public Shareable

Information you're comfortable sharing with any platform. Examples: learning goals, experience level, general preferences.

goal: "learn_guitar" experience: "beginner"
Consent Required Ask First

Information that requires explicit permission before sharing. You'll be prompted each time a platform requests access.

budget_range: "low" schedule_type: "shift_work"
Private Local by Default

Sensitive context that influences your experience while compatible flows share derived flags instead of raw details.

health_details: [LOCAL ONLY] → constraint_flag: "energy_variable"

How Privacy Flags Work

The core innovation: your private circumstances become simple boolean flags.

Your Private Context

What you know:
  • "I live in an apartment with thin walls"
  • "My neighbor works night shifts"
  • "I can't make loud noise after 9pm"
VCP converts this to

What Platforms See

noise_restricted: true No context, no details, just the flag

The platform knows to recommend quiet practice methods. It has no idea why you need them, and it doesn't need to know.

Trust Boundaries

Different stakeholders get different views of your context.

You Full context, all details
VCP Layer Processes context, applies privacy rules
Platforms See only what you've allowed

HR sees:

  • Career goal: Tech Lead
  • Training budget: €2,000
  • Preferred learning style

HR doesn't see:

  • Why you need flexible scheduling
  • Health circumstances
  • Personal situation details

Technical Implementation

Token Format

Context is encoded into CSM-1 (Compact State Message) tokens. Private fields are stripped before outbound VCP payloads by default.

No Central Storage

VCP is designed so private context can stay on your devices unless a separate integration explicitly documents storage or sync. We can't leak what we don't have.

Open Specification

The VCP protocol is open for inspection. You can review the specified privacy rules and test an implementation, while still evaluating the deployed code, configuration, operators, storage, and downstream services you trust.

Transport Security (VCP/T)

VCP/T defines how constitution bundles are signed and verified. A conforming application must enforce a verify-then-inject boundary so rejected or unsigned bundle content cannot reach the model through that path.

Signed Bundles

Every schema-conforming constitution bundle carries a supported digital signature. The manifest's key claim is untrusted input until it matches an independently configured, valid issuer trust anchor and the signature verifies.

Content-Addressed Storage

Content is hashed with SHA-256. The hash is embedded in the signed manifest, binding the signature to the exact bytes. Any tampering invalidates the hash.

Verify-Then-Inject

Signature verification must pass before content reaches the LLM. If verification fails, the bundle is rejected and the request fails closed -- no fallback to unsigned content.

Temporal Claims

Manifests carry iat, nbf, exp, and jti fields. Expired or replayed bundles are rejected, preventing replay attacks.

Verify-Then-Inject Flow

The orchestrator acts as a gatekeeper: nothing reaches the LLM without passing cryptographic verification first.

Repository
Orchestrator
LLM
1 Fetch bundle
manifest.json + content.txt
2 Verify Ed25519 signature
3 Check SHA-256 content hash
4 Check revocation list
5 Log to audit trail
6 Inject verified text
7 Apply constitution

Threat Model

VCP/T is designed to mitigate specific, enumerated threats. Each attack vector has a concrete defense.

Prompt Injection via Constitution

Attacker modifies constitution content to inject malicious instructions.

Defense The signed SHA-256 hash detects modification. Injection safety remains a separate review, scanning, delimiting, and model-boundary problem; a signature can faithfully preserve malicious content.

Replay Attacks

Attacker re-submits a previously valid but now-stale bundle.

Defense Temporal claims (iat/nbf/exp) plus unique jti tracking reject duplicates.

Context Overflow

Oversized constitution monopolizes the LLM's context window.

Defense Token budget enforcement -- manifest declares max_tokens and orchestrator enforces the limit before injection.

Key Compromise

Author's signing key is stolen or leaked.

Defense Remove the compromised key from trusted anchors, rotate it through a controlled release, revoke affected bundle JTIs where configured, and investigate every accepted use of the key.

Downgrade Attacks

Attacker substitutes an older, weaker version of a constitution.

Defense Application policy pins accepted bundle identities and versions. Capability negotiation checks protocol compatibility; the current bundle orchestrator does not maintain a universal minimum-version registry.

Fail-Open Risk

Verification error silently allows unsigned content through.

Defense Keep formatting and model invocation reachable only from the verified branch. Define any cached or restricted fallback as a separate reviewed path, never as silent acceptance of the rejected bundle.

Personal State Privacy

Layer 3 (the R-line) carries real-time personal state -- cognitive load, emotional tone, energy level. These dimensions require the strongest protections.

Stripped by Default

The Demo Site keeps sensitive state in session storage and its sharing helpers omit private fields unless a scoped consent path allows them. Other implementations must enforce an equivalent boundary.

Boolean Flags Only

The privacy filter can derive coarse boolean flags such as energy_variable: true while withholding the underlying condition. Applications must use the filtered projection rather than serialising the full source object.

Signal Decay

Personal state carries a TTL (time-to-live). Stale dimensions automatically decay, ensuring outdated state is not retained or acted upon.

Explicit Consent

Sharing personal state with any platform requires explicit, revocable consent. Each dimension can be consented to individually -- granular, not all-or-nothing.

Report a Security Issue

Do not open a public issue for a suspected vulnerability. The Demo repository is private, so its GitHub advisory form is not an external reporting channel. Email security@creedspace.com. Include safe reproduction steps, the affected route or component, and the candidate or deployed build identity. Do not send live credentials, personal data, or third-party secrets.

The current contact, policy, and expiry are also published in security.txt.

See Privacy in Action

Watch how different stakeholders see different views of the same context.

View Dual Audit Trail Build Your Own Token