I Showed My CISO Kiro Crew: Here's the Security Model That Got It Approved

5-min demo: AI agent investigates a P1, gets BLOCKED on dangerous commands, then fixes it with human approval. 8 layers, 137 deny patterns, signed audit logs.