Symbiotic Architecture Protocol: A Control Layer for Structural Security Auditing with AI Agents

The Problem: Scanners Find Bugs, Not Broken Architecture

Current security tooling is excellent at detecting implementation-level issues: SQL injections, XSS, outdated dependencies, misconfigurations. But a system can pass every scanner and still be architecturally broken.

Consider the canonical example: an unauthenticated user accessing another user's data. A scanner flags the missing authorization check on the endpoint. A developer patches that endpoint. But the structural invariant — "authentication gates must precede all data access decisions" — remains implicit, unenforced, and violated elsewhere by another route.

This is not a bug. It is an invariant rupture.

What is SAP?

The Symbiotic Architecture Protocol (SAP) is an operational specification for co-constructing structural security audits with AI agents. It is not a scanner. It is not a pentesting tool. It is a control layer for architectural reasoning.

SAP asks three questions before touching code:

1. What must always hold?
2. Where could it break?
3. What evidence proves it?

Core Idea: Structural Invariants

A structural invariant is a rule that cannot be violated without breaking a critical system property. Examples:

"An unauthenticated user never accesses another user's data."

"A financial transaction can never remain in an intermediate state."

"No component may write directly to the audit log."

Violating an invariant is a structural failure, not just a bug. SAP is designed to find these ruptures.

The Six Phases

Every phase produces documented, hash-attested output.

The Human-AI Contract

SAP treats the AI agent as a Security Co-Architect, not an oracle. The human engineer (the Origin Node) retains veto authority over every invariant declaration and rupture confirmation.

The agent proposes, asks, models, and documents. The human validates, confirms, and decides. This is symbiosis, not substitution.

Key rules:

• Epistemic synchronization before every phase transition
• No autonomous action on production systems
• Every finding classified as: design, implementation, configuration, process, or dependency failure
• No evidence, no finding

Forensic Traceability

Every output is protected by:

• SHA-256 hashing of each phase document
• OpenTimestamps attestation on the Bitcoin blockchain
• Chain of custody linking invariant → evidence → remediation → timestamp

The forensic layer measures the integrity of documentation, not the severity of the finding. A critical rupture and a minor config error receive the same cryptographic treatment.

What SAP is Not

• ❌ Not a vulnerability scanner
• ❌ Not a pentesting tool
• ❌ Not a replacement for formal verification
• ❌ Not a replacement for code analysis
• ❌ Not a replacement for penetration testing

It is a complementary layer for structural reasoning.

Operational Validation

The protocol has been applied in live security auditing engagements (public bug bounty programs). It identified structural attack surfaces — GraphQL schema exposure, internal service enumeration, architectural boundary violations — that conventional SAST/DAST tooling does not evaluate.

High-value vectors (order manipulation, payment flow tampering) were correctly classified as hypotheses when blocked by legitimate authentication or KYC requirements. No false positives were reported. No destructive testing was performed.

Get the Paper and the Spec

📄 Academic Paper (Zenodo, citable DOI):

https://doi.org/10.5281/zenodo.21925439

💻 Operational Specification (GitHub):

https://github.com/Leesintheblindmonk1999/SAS-Prompt-Symbiotic-Agent

The repo includes:

• Bilingual operational protocol (en/, es/)
• protocol.md summary
• CODE_OF_CONDUCT.md and SECURITY.md
• Field evidence of operational use

Citation

@software{durante2026sap,
  author       = {Durante, Gonzalo Emir},
  title        = {Symbiotic Architecture Protocol (SAP): Operational Specification
                  for Invariant-Based Security Co-Architecture},
  year         = {2026},
  publisher    = {Zenodo},
  doi          = {10.5281/zenodo.21925439},
  url          = {https://doi.org/10.5281/zenodo.21925439}
}

Feedback Welcome

This is a research-alpha protocol. If you audit systems at the architectural level, or if you think current tooling misses the forest for the trees, I'd value your critical perspective.

Gonzalo Emir Durante — Independent Researcher

Contact: duranteg2@gmail.com