Secure by design

Run an enterprise security review of a system design or existing code before it ships. Use when the user says "security review", "secure by design", "threat model this", "is this design secure", "what security controls do we need", "audit this for security", "harden this system", "RBAC design", "review my auth", or "enterprise security checklist". Classifies assets and trust boundaries FIRST, then recommends only the controls that fit — grounded in battle-tested patterns. Right-sizes for team scale (bones now, ceremony later). Do NOT use for writing a specific exploit, penetration-testing a system the user does not own, or general non-security code review.