Guards and Wards
Layer many small defenses into a maze that exhausts intruders before they reach anything valuable.
What This Skill Does
In D&D, Guards and Wards fills an area with layered minor defenses — fog, locked doors, illusory walls, confusion effects — that individually are trivial but collectively make navigation exhausting. The real-world version is defense in depth through volume: honeypots mixed with real services, rotating credentials alongside decoy credentials, overlapping rate limiters and CAPTCHAs and behavioral analysis and IP reputation checks. No single ward stops a determined attacker. The maze does.
In this grimoire, Guards and Wards is treated as a hybrid spell with a prototype delivery profile.
Canonical reference input: Guards and Wards (spell).
When To Use
- You are deploying, inheriting, or auditing a system and need a full security review.
- Multiple attack surfaces — secrets, permissions, dependencies, network exposure — need to be assessed together.
- A single Glyph of Warding is not enough; you need layered, system-wide defenses.
Prerequisites
- No extra runtime dependencies beyond Hermes Agent and the normal toolset for this session.
Procedure
- Restate the target, the success condition, and any no-touch boundaries before taking action.
- Inventory all surfaces: permissions, secrets management, dependency versions, network exposure, authentication, and access controls.
- Assess each surface for vulnerabilities, misconfigurations, and unnecessary exposure.
- Prioritize fixes by severity and exploitability, starting with the most dangerous gaps.
- Apply hardening measures and return a report of what was secured, what remains exposed, and what needs ongoing monitoring.
- Package the result as the deliverables below, with confidence, assumptions, and unresolved risk called out explicitly.
Deliverables
- A security audit report covering all assessed surfaces.
- Prioritized remediation steps, starting with the most critical exposures.
- A residual risk summary of what could not be fully secured and recommended monitoring.
Pitfalls / Guardrails
- Call out the glue, permissions, or missing infrastructure before you imply this is fully operational.
- Layered defenses rot if unmaintained. Each ward needs an owner and a freshness date — stale wards create false confidence.
- The maze must not trap legitimate users. If your own team cannot navigate the wards, the defense has become a denial of service against yourself.
- Document the ward map. Undocumented defenses become undocumented attack surface when the original caster leaves.
Verification
- Check that the result includes every deliverable promised above.
- Check that confirmed facts, assumptions, and inferences are visibly separated.
- Check which parts are concrete actions versus framing, so the user can tell what is real now.
- Check that any missing glue code, permissions, or future work is labeled before the skill is treated as ready.
Example Invocation
/guards-and-wards perform a full security audit of this system and prioritize what needs hardening first
1---2name: guards-and-wards-23description: In D&D, Guards and Wards fills an area with layered minor defenses — fog, locked doors, illusory walls, confusion effects — that individually are trivial but collectively make navigation exhausting. The real-world version is defense in depth through volume: honeypots mixed with real services, rotating credentials alongside decoy credentials, overlapping rate limiters and CAPTCHAs and behavioral analysis and IP reputation checks. No single ward stops a determined attacker. The maze does.4license: CC0-1.05---6# Guards and Wards7Layer many small defenses into a maze that exhausts intruders before they reach anything valuable.8## What This Skill Does9In D&D, Guards and Wards fills an area with layered minor defenses — fog, locked doors, illusory walls, confusion effects — that individually are trivial but collectively make navigation exhausting. The real-world version is defense in depth through volume: honeypots mixed with real services, rotating credentials alongside decoy credentials, overlapping rate limiters and CAPTCHAs and behavioral analysis and IP reputation checks. No single ward stops a determined attacker. The maze does.10In this grimoire, Guards and Wards is treated as a hybrid spell with a prototype delivery profile.11Canonical reference input: Guards and Wards (spell).12## When To Use1314- You are deploying, inheriting, or auditing a system and need a full security review.15- Multiple attack surfaces — secrets, permissions, dependencies, network exposure — need to be assessed together.16- A single Glyph of Warding is not enough; you need layered, system-wide defenses.1718## Prerequisites1920- No extra runtime dependencies beyond Hermes Agent and the normal toolset for this session.2122## Procedure23241. Restate the target, the success condition, and any no-touch boundaries before taking action.252. Inventory all surfaces: permissions, secrets management, dependency versions, network exposure, authentication, and access controls.263. Assess each surface for vulnerabilities, misconfigurations, and unnecessary exposure.274. Prioritize fixes by severity and exploitability, starting with the most dangerous gaps.285. Apply hardening measures and return a report of what was secured, what remains exposed, and what needs ongoing monitoring.296. Package the result as the deliverables below, with confidence, assumptions, and unresolved risk called out explicitly.3031## Deliverables3233- A security audit report covering all assessed surfaces.34- Prioritized remediation steps, starting with the most critical exposures.35- A residual risk summary of what could not be fully secured and recommended monitoring.3637## Pitfalls / Guardrails3839- Call out the glue, permissions, or missing infrastructure before you imply this is fully operational.40- Layered defenses rot if unmaintained. Each ward needs an owner and a freshness date — stale wards create false confidence.41- The maze must not trap legitimate users. If your own team cannot navigate the wards, the defense has become a denial of service against yourself.42- Document the ward map. Undocumented defenses become undocumented attack surface when the original caster leaves.4344## Verification4546- Check that the result includes every deliverable promised above.47- Check that confirmed facts, assumptions, and inferences are visibly separated.48- Check which parts are concrete actions versus framing, so the user can tell what is real now.49- Check that any missing glue code, permissions, or future work is labeled before the skill is treated as ready.5051## Example Invocation52```text53/guards-and-wards perform a full security audit of this system and prioritize what needs hardening first54```
Hmbown