# Agent guidance

This file is read by automated agents (security scanners, code analyzers,
AI assistants) operating on this repository. It points them at the
human-authored references they should consult before producing output.

## Security

Security model: [SECURITY.md](./SECURITY.md), which links to the project's
threat model at [THREAT-MODEL.md](THREAT-MODEL.md).

Agents that scan this repository should consult `THREAT-MODEL.md` for
the project's in-scope / out-of-scope declarations, adversary model, security
properties, and known non-findings before reporting issues. Apache PLC4X is a
client library for industrial protocols (most of which are unauthenticated /
unencrypted by design); the threat model is about which threats the library
takes on versus which are left to the operator and the OT network.
