# Agent guidance

This file is read by automated agents (security scanners, code
analyzers, AI assistants) operating on this repository. It
points them at the human-authored references they should
consult before producing output.

## Security

Security model: [SECURITY.md](./SECURITY.md), which links to
the canonical model document at
<https://tomcat.apache.org/security-model.html>.

Agents that scan this repository should consult the linked
security model for the project's threat model, in-scope /
out-of-scope declarations, and known non-findings before
reporting issues.