---
title: "Your Harness Needs a Security Constitution: Kat Traxler on 12 Principles of Cloud Trust"
description: "Kat Traxler brings a hunting methodology built on 12 principles about trust in multi-tenant cloud platforms, judged by a reasonable customer test, with 90+ valid cloud-specific findings behind it. A preview of the Day 1 talk from the published abstract."
author: "Mara Voss"
category: "AI Security Conferences"
date: 2026-10-22T13:05:05.199Z
canonical: "https://agenticcyber.co/blog/unprompted-ii-kat-traxler-security-constitution"
---

# Your Harness Needs a Security Constitution: Kat Traxler on 12 Principles of Cloud Trust

![Photograph illustrating stone pillars architecture.](https://hsppuvezyxmkpzkgfkho.supabase.co/storage/v1/object/public/media/conference/5bc07ae2-9ee0-46b9-9820-b0704936f742/unprompted-ii-kat-traxler-security-constitution.jpg)

> Kat Traxler brings a hunting methodology built on 12 principles about trust in multi-tenant cloud platforms, judged by a reasonable customer test, with 90+ valid cloud-specific findings behind it. A preview of the Day 1 talk from the published abstract.

Most hunting methodologies tell a model what to look for. This one tells it what trust is supposed to mean, and lets the model work out what violates that. The claim you may want to argue with: in a multi-tenant cloud platform, the finding that matters is rarely a spec violation, so a hunt guided by principles beats a hunt guided by a checklist. **Kat Traxler** brings that argument to **[un]prompted II** — people type it *unprompted* — with 90+ valid cloud-specific findings behind it. Our [guide to the conference](/blog/unprompted-ii-conference-guide) has the full programme.

The talk is *Your Harness Needs a Security Constitution*, from **Kat Traxler** (Principal Security Researcher, Vectra AI), Day 1, Stage 1, 16:20, per the [official agenda as published on 2026-10-12](https://unpromptedcon.org/agenda-10-2026/). We wrote this from that published abstract, before the talk. We are independent coverage — not the organiser, not a sponsor, not a media partner — and we are following the conference remotely. Nothing here is a quote, and agendas change.

## What the unprompted abstract says it will show

A hunting methodology that guides models with **12 principles** about trust in multi-tenant cloud platforms. The principles are modelled on a published AI constitution, and findings are judged against a **“reasonable customer test”**. The abstract reports **90+ valid cloud-specific issues across multiple providers**.

Two things there do real work. The constitution is normative, not procedural: it states what should be true about trust rather than listing where to look. And the reasonable-customer test is an acceptance criterion for a class of bug that usually has nowhere to go.

## Why this is the hard part

Our analysis, not the speaker's. Cloud platform weaknesses are hard to report because they are frequently *documented*. A service that can read another service's data, a role that a tenant cannot see, an audit trail that stops at the boundary: none of these violate a published specification, so the usual argument ends with “working as designed”. The research question is not “is this permitted” but “would a customer who read the documentation expect this”.

That is a judgement, and judgement is what a model holds least consistently across a long hunt. A constitution pins it down once, in text, so every run is measured against the same standard — and a human who disagrees can argue with the standard. That is more than most hunting prompts offer.

It also raises the line we keep drawing between guidance and enforcement:

A constitutionA policy engine

Normative: states what trust should meanOperational: decides whether this call proceeds
Interpreted by a model, argued with by a humanEvaluated deterministically, same answer every time
Good at naming a finding nobody has a rule forGood at stopping something you already named
Fails quietly, by driftingFails loudly, by blocking the wrong thing

Both are needed, and teams keep collapsing them into one artefact. We made the same point about [moving from RBAC to ABAC for agents](/blog/from-rbac-to-abac-a-practical-access-control-roadmap-for-ai-agents-and-autonomou): attributes express an intent, they do not hold it for you. Oleksii Baranovskyi (Cracken) and his Day 1 session on the harness as an enforceable compliance boundary takes the enforcement half; this talk takes the normative half.

## What we will be watching for

- **Whether the 12 principles are published verbatim.** A constitution that stays internal is a prompt. Published, it becomes something other teams can fork and contest.

- **Who adjudicates the reasonable-customer test.** If the same model that found the issue also rules on whether a reasonable customer would be surprised, the test grades its own homework.

- **What “valid” means in “90+ valid findings”.** Valid by the methodology's own criteria, accepted by a provider, and remediated are three different counts, and the gap between them is the real story.

- **The false-positive cost.** A principle-guided hunt should produce more candidates, not fewer. The number worth hearing is how many were discarded per keeper.

## If this holds, what changes on Monday

- **Write your own trust assumptions down before pointing a model at your cloud.** Not controls — assumptions. “A tenant cannot influence another tenant's control plane” is a testable sentence; “harden IAM” is not.

- **Adopt the reasonable-customer framing in your own reports.** It converts “working as designed” into an argument about expectation, which is a conversation a vendor can actually lose.

- **Keep the normative document separate from the enforcement code.** When the two live in one file, every principle change becomes a deployment, and principles stop changing. This is the practical version of our argument that [least privilege gets harder with agents](/blog/least-privilege-harder-with-ai-agents).

## Three questions we would ask Kat Traxler

- Where is the line between a principle that belongs in the constitution and a rule that belongs in a policy engine? The failure mode we expect is a constitution that slowly fills up with controls.

- Who adjudicates the reasonable customer test when the model and the provider disagree — a human reviewer, a second model, or the provider's own documentation?

- Do the 12 principles transfer off cloud? A multi-tenant SaaS platform and an agent harness have a similar trust shape, and it would be useful to know which principles are cloud-specific.

Those are the questions the abstract leaves open; we will update this page if the principles are published. Governance by written principle runs through the whole programme — Josh Woodruff on governance as code, Sounil Yu on least agency, David Chismon on a cyber ontology for agents — and we mapped those threads in [the six arguments running through [un]prompted II](/blog/unprompted-ii-six-arguments).

## FAQ

### What is a security constitution in this context?

Per the published abstract, a set of 12 principles about trust in multi-tenant cloud platforms, modelled on a published AI constitution, used to guide a model's hunting rather than to enforce anything at runtime. Findings are judged with a reasonable customer test.

### Does a constitution replace guardrails?

No, and nothing in the abstract claims it does. A normative document guides what a model treats as a finding. It does not stop a tool call, does not block a request, and offers no protection against prompt injection into the hunt itself.

### Is this coverage from inside the conference?

No. We are independent coverage, following remotely, and the talk is on Day 1 at 16:20. Every session fact comes from the official agenda as published on 2026-10-12. The affiliation is exactly as the agenda lists it: Principal Security Researcher, Vectra AI.


---
Source: https://agenticcyber.co/blog/unprompted-ii-kat-traxler-security-constitution