Add AGENTS.md guidance and expand Security policy library

Security/password_policy_generic.md

@@ -22,6 +22,7 @@ This policy establishes mandatory requirements for password creation, management
 ### 2.2 Complexity
 - Passwords **must not** be subject to composition rules requiring upper/lowercase, numbers, or symbols.  
 - Passwords **must** be screened against a blocklist of weak, common, or compromised passwords.  
+- Passwords **must not** match the user's current password or any of the last **5** passwords (where technically supported).  
 
 ### 2.3 Expiration
 - Passwords **shall not** expire on a scheduled basis.  
@@ -34,6 +35,7 @@ This policy establishes mandatory requirements for password creation, management
 
 ### 2.5 Multi-Factor Authentication (MFA)
 - MFA **must** be enforced for:  
+  - All employee, SaaS, and external-facing logins (per Authentication Policy AAL2 baseline)  
   - Remote access  
   - Administrative access  
   - Access to sensitive data or critical systems  
@@ -76,6 +78,11 @@ Applications authenticating users:
 - **Must** allow paste/autofill and must not truncate passwords.  
 - **Must** store verifiers using modern password hashing methods.
 
+### 2.13 Kill-Chain Credential Protection (Barbell Principle)
+- Credentials that gate existential systems — PKI/CA root passphrases, backup encryption keys, break-glass vault master credentials, HSM activation secrets — **must** receive protection disproportionate to ordinary accounts: **split-knowledge / dual control** (no single person holds the complete secret), physical or HSM-backed storage, and access logged with real-time alerting.  
+- Do **not** spread equivalent extra effort across low-value accounts — moderate protection applied broadly buys neither real security for what matters nor economy for what doesn't. Concentrate paranoia on the kill-chain few; keep the baseline (§2.1–§2.12) lean everywhere else.  
+- Full requirements and rotation cadence: see [Secrets & Key Management Policy §2.5](secrets_management_policy.md) — canonical source for this control.
+
 ---
 
 ## 3) Enforcement
@@ -91,6 +98,6 @@ Applications authenticating users:
 ---
 
 ## 5) References
-- **NIST SP 800-63B, Digital Identity Guidelines (2023 update)**  
-- **CIS Controls v8.1, Controls 5 & 6**  
-- **OWASP Authentication Cheat Sheet**  
+- **[NIST SP 800-63B, Digital Identity Guidelines (2023 update)](https://pages.nist.gov/800-63-3/sp800-63b.html)**  
+- **[CIS Controls v8.1, Controls 5 & 6](https://www.cisecurity.org/controls/v8-1)**  
+- **[OWASP Authentication Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html)**