# Security Architecture Review

> Use when a completed technical design needs its independent security pass: reviewing design.md for security NFR evidence, tenant and auth boundary coverage, and naming every security gap found. This is the security_architecture_review action of the design stretch — one Agent-tool dispatch with subagent_type security-reviewer — a design-level review by a role that did not write the design, distinct from planning-security-scope (requirements-level) and security-review (implementation-level).

- Skill: `bhangeef16/security-architecture-review` (Agent Skill)
- Install (CLI): `npx skillmds@latest add bhangeef16/security-architecture-review`
- Raw SKILL.md: https://api.skillmd.com/api/skills/bhangeef16/security-architecture-review/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: BhangeeF16 (https://skillmd.com/u/bhangeef16)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/bhangeef16/security-architecture-review

---


# Security Architecture Review

Review the design's security architecture with fresh eyes. The Solution Architect ran their own security checks while designing; this pass exists because the designer reviewing their own boundaries is not independence.

## Dispatch

One synchronous `Agent`-tool call, `subagent_type: security-reviewer`.

## Required inputs

- `design.md`.

## Required outputs (all mandatory)

- Security NFR evidence.
- Tenant and auth boundary review.
- Security gaps, named explicitly — an empty gap list is stated, never implied.

## Rules

- A security gap found here routes the run back to this design stretch, not forward — advancing with a known unaddressed gap is what this action exists to prevent.

## Result

Report each required output produced (with its location), the result (pass / pass_with_risks / blocked / failure), and blocking questions as an explicit list (empty list stated explicitly).