ssot-write-gate

To prevent unauthorized file writes, you need a write gate that validates artifact target paths against Single Source of Truth (SSOT) sovereign territories. This enforces predefined path validation rules, ensuring files are only saved to whitelisted directories and canonical artifact type locations.

SSOT path validation is a data governance mechanism that checks target write paths against predefined sovereign territories before any file write operation. It guarantees that artifacts like plans, evidence, and reports are stored in their canonical directories, maintaining strict repository organization.

You enforce canonical artifact locations by applying path validation rules before file write operations occur. This automatically verifies that artifacts like research reports are placed in predefined directories such as docs/reports/plans/ instead of arbitrary user home directories.

Yes, you can block file writes to user home directories and IDE configuration paths by using a security guardrail. This write gate intercepts file operations and rejects any target paths that do not match the repository root or whitelisted directories.

Yes, path security validation requires predefined path validation rules and artifact type mappings to function correctly. These mappings define the sovereign territories and canonical locations that the write gate checks against before allowing any file write operation to proceed.

The limitation of using a write gate for data governance is that it strictly requires adherence to predefined path validation rules and artifact type mappings. It cannot dynamically adapt to new directories or artifact types unless those sovereign territories are explicitly defined beforehand.