Profile And Level

Choosing a profile and level

Two independent dials. Getting them right at the start saves you from a fix queue that is either meaningless or impossible.

Profile: how many rules apply

Bronze ⊂ Silver ⊂ Gold, cumulative. A profile is the lowest tier that includes a rule, so raising the profile only ever adds obligations.

Profile	For
Bronze	Any static surface. The floor: self-hosting, a CSP, clickjacking control, the basic headers
Silver	A surface where privacy matters. Adds runtime egress proof, service-worker hygiene, report-only staging, most of the supply chain
Gold	A surface where the property is the product. Adds signing, hermetic-build hints, and the strictest governance, including waivers signed by an approver distinct from the author

Gold requires cosign, and at Gold keyless signing in the Action needs id-token: write.

Level: how strict the egress rule is

Level	Means
L0	Strict air-gap. The surface talks to its own origin and nothing else
L1	Scoped egress. A declared, enumerated set of external destinations is allowed
L2	Marketing. The realistic band for a page that carries analytics or embeds and still wants the rest of the hardening

The level changes obligations, not just thresholds. AG-NET-05, no third-party egress during load, is a MUST at L0 and a SHOULD at L1. AG-NET-04, constrain connect-src, is a MUST at L0 and L1 and conditional at L2.

The common mistake

Declaring L0 on a surface that has analytics. Every scan is then a long list of failures describing a decision you already made deliberately, and the queue stops being information.

The level is a declaration of intent, not an aspiration. Declare what the surface actually is, fix everything at that level, and then consider whether you can tighten it. A conformant L2 is worth more than a permanently red L0.

Choosing, in practice

Your surface	Start at
A client-side tool where privacy is the point	Silver, L0
A docs site, self-hosted assets	Bronze, L0, then Silver
A marketing page with analytics and embeds	Bronze, L2
A product whose selling point is that data stays local	Gold, L0

Start one notch below where you want to end up. A green gate you then tighten is a working process; a red gate from day one gets disabled.

Scores do not compare across levels

The score is level-relative: a ratio over the rules in scope at the declared level. So 82% at L2 and 82% at L0 are not the same achievement and cannot be ranked against each other.

Compare medals, not numbers. The medal is the claim; the score is a development diagnostic that also moves with your environment, since an INCONCLUSIVE from a missing scanner counts against you.