diff --git a/.intentignore b/.intentignore
new file mode 100644
index 0000000000..a2ada1d8be
--- /dev/null
+++ b/.intentignore
@@ -0,0 +1,10 @@
+# GLOBAL SECURITY BOUNDARY
+.env
+.git/
+node_modules/
+.orchestration/trace_storage.db
+.clinerules
+
+# INTENT-SPECIFIC PROTECTION
+# Prevents the AI from modifying the core orchestration logic
+.orchestration/hooks/
diff --git a/.orchestration/security_policy.json b/.orchestration/security_policy.json
new file mode 100644
index 0000000000..ec4079b38a
--- /dev/null
+++ b/.orchestration/security_policy.json
@@ -0,0 +1,11 @@
+{
+  "version": "1.0.0",
+  "command_classification": {
+    "safe": ["read_file", "list_files", "search_files"],
+    "destructive": ["write_to_file", "delete_file", "execute_command"]
+  },
+  "error_protocol": {
+    "type": "JSON_TOOL_ERROR",
+    "template": "Scope Violation: {intent_id} is not authorized to edit {file}. Request scope expansion."
+  }
+}