Charter

Mission

The Citadel Project publishes open standards for Microsoft security decisions that would otherwise be made by opaque, vendor-specific, or purely internal judgement.

Administrators are routinely asked to answer questions like “how risky is this application?” or “is this directory role critical or merely high?” — and today they answer them with tooling whose reasoning they cannot inspect, or with tribal knowledge they cannot defend in an audit. Where a rating exists, the method that produced it is usually invisible.

We publish the method, not just the answer.

Principles

Open method. Every rating a Citadel standard produces can be traced to published factors, published weights, and published rationale. If you disagree with a rating, you can see exactly which input to argue about.

Evidence over assertion. Scoring inputs must be programmatically retrievable from authoritative sources. Self-attestation and vendor marketing claims are not inputs.

Machine-readable first. Every standard ships JSON that tools can consume directly. A standard that only humans can read cannot be enforced consistently, and prose alone has no test suite.

Vendor-neutral. Standards are written so that any tool can implement them. No implementation — including those built by our own contributors — receives preferential treatment in the specification.

Nobody owns it. Roles rotate, decisions are made in public, and the licence guarantees the work stays open regardless of who maintains it. Founding authors are credited permanently; nobody holds a permanent veto.

Scope

In scope:

• Risk classification and rating models for Microsoft identity and security objects — applications, permissions, directory roles, and comparable constructs
• Machine-readable datasets that apply those models to real, enumerable objects
• Reference material that helps implementers apply a standard consistently

Out of scope:

• Product reviews, vendor comparisons, or endorsement of specific tooling
• Prescribing any organisation’s risk appetite. We define how to measure risk; what to do at each tier is a local policy decision
• Vulnerability disclosure or incident coordination for Microsoft products. Report those to MSRC

Standards

Standard	Status	Description
OARS — Open App Risk Standard	Draft	Rating the risk of applications and the permissions they request
Entra role tiering	Planned	Classifying directory roles as Critical / High / Medium / Low

Each standard is developed by a working group with its own spec editors, under the shared governance described in GOVERNANCE.md.

Licensing

What	Licence	Why
Specifications and datasets	CC BY 4.0	Anyone may use, adapt, and redistribute — attribution is required, which is how founding authors stay credited
Code — tooling, build scripts, site	MIT	Maximum freedom for implementers

This split is deliberate. Attribution matters for the intellectual work; it should not encumber someone’s build pipeline.

Amending this charter

Charter changes follow the governance-change process in GOVERNANCE.md: a public proposal, a minimum 14-day comment period, and a two-thirds majority of maintainers.