# Security

Control what agents can do, encrypt sensitive data, and defend against prompt injection.

## Pages

- [Approvals and Annotations](approvals-and-annotations.md) — `@ApprovalRequired`, `@Security`, per-action gates.
- [Guardrails](guardrails.md) — three different APIs that share the name: action I/O annotations, supervisor permission, content evaluation.
- [PII input guardrails](pii-input-guardrails.md) `@InputGuardrail` `PiiInputValidator` / `PiiInputSanitizer` (TnsAI #168 / TAN-3016).
- [Enforcement](enforcement.md) — `SecurityEnforcer`, access control, audit logging.
- [Encryption](encryption.md) — AES-256-GCM at-rest, envelope encryption.
- [Prompt Injection](prompt-injection.md) — Detection and mitigation.
- [Redaction](redaction.md) — `Redactor` SPI, default pattern catalog, per-tenant policy dispatch, audit events.
- [Cost Governance](cost-governance.md) — `CostBudget` per tenant / agent / capability, `BudgetState` snapshots, hierarchical scope rollup, hard-stop / soft-warn / defer policies.
- [Accountability](accountability.md) — `AgentPrincipal` verifiable identity, `AgentLiabilityRecord` audit trail, `AuthorityScope` bounds, `ReputationLedger`, `PaymentBroker` for agent-to-agent settlement.
- [Sandbox](sandbox.md) — `Sandbox` SPI for isolated execution, `ProcessSandbox` / `ContainerSandbox` backends, `SandboxPool`, per-execute observability events.
- [Server Hardening](server-hardening.md) — `tnsai-server` HTTP/WS surface: bind policy, Bearer auth, Origin allowlist, per-session capability tokens, workspace allowlist for `/api/index`.
- [Code Review Harness](code-review-harness.md) — `CodeReviewPipeline` (deepsec pattern), `MatcherSpi` + 10 built-in CWE matchers, `ReviewAgentSpi` for LLM-driven review, `FileSystemPipelineStateStore`, SARIF / JSON / Markdown exporters.