The police arrived at TatuEngine — security as a process, not a document

The engine that knew how to act, but not how to protect itself

TatuEngine had already done a lot by now: it learned to infer (BitMamba-2 1B on GPU with massive speedup), learned to act (autopoietic agent with 8 subsystems, ToolUse, GoalStack, LTM), and was learning to learn (Master-Apprentice loop). Underneath all of that, a hybrid sandbox with 51/51 path-validation tests.

It felt safe. But security is not a feature — it’s a process. And process is exactly what TatuEngine didn’t have documented.

The context: the most autonomous agent in the ecosystem

Here’s the problem that was nagging me: TatuEngine is the project with the most autonomy in my entire ecosystem. It has an agent that:

• Executes tools via ToolUse (it doesn’t just read — it acts)
• Exposes an MCP server with tool_execute (stdio/SSE)
• Writes and reads files (hybrid sandbox)
• Persists state (.brain checkpoint with CRC32)

Meanwhile, the rest of the ecosystem had already adopted a continuous security policy — LifeLog, Portfólio and LEVE LAVANDA got SEGURANCA.md on 04/08, with the rule that became a philosophy: “security is ongoing monitoring, not a static document”.

TatuEngine was the gap. The most powerful engine in the ecosystem was the only one without a formal defense plan.

The struggle: inventory what exists before building

The ecosystem rule says audit before improving. So the first step wasn’t writing a firewall — it was inventorying what TatuEngine already had in terms of protection. The result surprised me: the project was more armored than I thought.

# The sandbox — the frontier
# Three pillars:
#  1. Path traversal prevention (resolve + prefix check)
#  2. File size & type enforcement
#  3. Read vs write scope control
result = sandbox.check_read("~/projetos/meu-arquivo.txt")
if result.ok:
  path = result.path  # resolved path with prefix check

The sandbox existed. The Tool Registry existed. The MCP server existed. The .brain had CRC32. What was missing was consolidating all of it into a single document with principles, inventory, gaps and roadmap — and, above all, automating the surveillance.

# security-scan-tatuengine.sh — daily scan at 07:30
# 1. Gitleaks (secrets in repo — history + working tree)
# 2. .env permissions (must be 600)
# 3. Hardcoded secrets in src/ (sk_live_, AKIA, ghp_, private keys patterns)
# 4. Git history of .env (should never have been committed)
# 5. Dockerfile USER directive
# Summary:  Pass /  Warnings /  Critical /  Fail

The scan is honest: it fails if it finds a critical (exit 1), warns on warnings, and stays quiet when everything is fine. First run after the document: 3 pass, 0 warnings, 0 criticals.

The resolution: SEGURANCA.md v1.0 + a watchdog that never sleeps

The document was born with 5 principles that became the project’s security identity:

1. Defense in depth — network → process → sandbox → data → human
2. Least privilege — each tool/agent with the MINIMUM access needed
3. Sandbox is the frontier — AI tool execution only through the sandbox
4. Ecosystem standard — gitleaks, .env out of git, secrets never hardcoded
5. Audit before improving — find the holes first, then build on top

And what closes the loop: a 24h watchdog (TatuEngine Security Watchdog) that runs every day, stays silent when everything is OK and only shouts on Telegram when it finds a problem. Continuous surveillance, not weekend auditing.

The roadmap landed in 4 phases — and Phase 1 (base) closed on the same day:

Metrics

Lessons learned

1. Security is ongoing monitoring, not a static document — SEGURANCA.md doesn’t protect anything by itself; what protects is the daily scan + the 24h watchdog + the rule in AGENTS.md.
2. Inventory before hardening — TatuEngine already had 80% of the protection; what was missing was consolidating, documenting gaps and automating surveillance. Auditing first avoids building what already exists.
3. The most autonomous agent needs the strictest frontier — ToolUse + MCP server + file writes = real attack surface. The sandbox is the single point of control, and now it has formal policy behind it.
4. Silent surveillance is the best surveillance — the watchdog only speaks when there’s a problem. No noise, no false alerts, no notification burnout.

╔══════════════════════════════════════╗
║  Samuel Medeiros                    ║
║  Senior Software Engineer           ║
║  Stack: Python · TypeScript · Rust  ║
║  Projetos: Arachne, Dogwalk,        ║
║            Capivara, TatuEngine      ║
╚══════════════════════════════════════╝