The dedicated AI user is a security boundary, not merely a different home directory. The implementation must combine identity separation, least privilege, isolation, mediation, audit, revocation, and recovery.

• Create the AI user as a separate non-root UID with no default administrative group membership or unrestricted sudo path.
• Deny capabilities by default and grant only named operations required for an approved use case.
• Keep grants narrow in target, action, data exposure, and duration.
• Prevent the model, prompts, downloaded content, and tool output from changing authorization policy directly.
• Separate policy decisions from model inference and treat model output as untrusted input.

• Give the AI user a separate home and private runtime directories.
• Deny human-user homes, system secrets, removable media, and sensitive service data by default.
• Use explicit mediated shares for individual files or directories instead of broad home-directory access.
• Define ownership, write limits, conflict handling, deletion protection, and revocation for every shared path.
• Avoid following attacker-controlled links or mount changes across boundaries.

• Never expose human keyrings, SSH or signing agents, browser sessions, cloud credentials, private keys, or reusable administrator tokens to the AI user.
• Prefer narrowly scoped brokered operations over handing credentials to a model process.
• Bind temporary credentials to an operation, target, and short lifetime.
• Make revocation possible without recreating the human account or reinstalling the system.

• Deny cameras, microphones, input devices, removable storage, raw disks, and other sensitive devices by default.
• Assign accelerators explicitly and account for driver, DMA, firmware, and cross-process isolation risks.
• Display or record active device grants and revoke them without granting root to the AI user.

• Prevent inspection, tracing, signaling, or modification of human-user and privileged processes.
• Constrain process count, memory, CPU, storage, and accelerator usage so the AI workload cannot make the system unrecoverable.
• Isolate temporary files, IPC, service sockets, environment variables, and session buses.
• Define deterministic behavior for crashes, resource exhaustion, and runaway workloads.

• Deny unrestricted network access by default.
• Grant destination, protocol, direction, and duration explicitly for approved workloads.
• Treat remote responses, downloaded models, prompts, and tool instructions as untrusted content.
• Make active network grants visible and revocable, and log policy decisions without recording secrets or unnecessary personal data.

• Require human approval for access to personal data, credentials, sensitive devices, persistent system changes, and elevated operations.
• Present the exact action, target, data exposure, and side effects before approval.
• Do not transform one approval into a reusable shell, token, group membership, or unlimited policy exemption.
• Keep a non-AI path for denial, cancellation, and emergency shutdown.

• Record capability requests, policy decisions, human approvals, execution outcomes, revocations, and security-relevant failures.
• Protect audit data from the AI user and separate integrity evidence from model output.
• Minimize personal and prompt content in logs while preserving enough context for investigation.
• Define retention, export, review, and clock-integrity requirements before claiming auditability.

• Provide a clear way to stop AI processes, disable the AI account and services, revoke grants, and block network access.
• Preserve human login and administrative recovery when AI components fail.
• Support rollback of system configuration and model/runtime updates to a known state.
• Define offline or rescue recovery that does not require the model, network, or normal AI services.
• Test recovery from compromised credentials, corrupted state, policy failure, resource exhaustion, and an unbootable update before release.

Every Git ref is mirrored publicly to GitHub. Do not commit credentials, personal data, private host information, restricted model artifacts, signing keys, or security-sensitive deployment state.