Architecting Security

This is your pre-code security design layer. It pushes you to run STRIDE, PASTA, or LINDDUN threat modeling before you ship new systems or cross trust boundaries, then map controls to SOC2, PCI, HIPAA, or GDPR requirements with evidence chains. The routing splits cleanly into threat modeling, identity and zero trust (IAM, SSO, MFA, PAM), and compliance artifacts. The decision matrix is sharp: SAML for enterprise SSO, OIDC for APIs and mobile; FIDO2 when phishing is a real threat; JIT privilege access for production. The iron law is worth repeating: threat list before code, controls must be evidence-backed, and residual risk goes in the design doc with explicit acceptance. It won't write policies for you, but it'll make you answer the right questions before your next security questionnaire lands.

Install to Claude Code

npx -y skills add telagod/code-abyss --skill architecting-security --agent claude-code