diff --git a/CLAUDE.md b/CLAUDE.md
index 7ad43eb2..58be5161 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -10,8 +10,6 @@ when you need depth on a subsystem. This file is the index.
 - Operator/agent trust-boundary design:
   **[docs/boundary.md](docs/boundary.md)** (`area:ops` issues
   for the deployment/gateway/privsep work).
-- Credential isolation + sandbox threat model:
-  **[docs/security.md](docs/security.md)**.
 
 ## File map
 
diff --git a/docs/security.md b/docs/security.md
deleted file mode 100644
index 32c6951c..00000000
--- a/docs/security.md
+++ /dev/null
@@ -1,33 +0,0 @@
-# Security model
-
-## Nix builds and credential isolation (issue #240)
-
-### Background
-
-Agent containers bind-mount the host's `nix-daemon` socket. The host daemon may
-have `sandbox-fallback = false` (strict NixOS defaults), which causes `nix build`
-inside nspawn containers to fail — containers lack kernel user namespaces, so nix
-cannot set up its build sandbox. `harness-base.nix` sets `sandbox-fallback = true`
-so that builds fall back to unsandboxed execution rather than failing outright.
-
-### Threat model
-
-Unsandboxed nix builds run as `nixbld` users (non-root, typically UIDs 30001-30010).
-Without sandbox isolation, a build derivation's builder script has read access to
-any file in the container that the nixbld user can read.
-
-**What is NOT exposed**:
-
-- `/root/.claude/` — mode `0700`, owned by root. nixbld users cannot read it.
-- `/state/forge-token` — written at mode `0600` by `hive-c0re/src/forge.rs`.
-  nixbld users cannot read it.
-
-**Policy**: all credential files written to agent state directories MUST be mode
-`0600` or stricter. Do not create world-readable secret files in agent state dirs.
-
-### Long-term fix
-
-The proper fix is to enable user namespaces inside nspawn containers
-(`--private-users=inherit` in `EXTRA_NSPAWN_FLAGS`) so nix can set up its real
-sandbox and `sandbox-fallback` becomes a true last resort. This requires verifying
-bind-mount compatibility with user namespace UID mapping and is tracked as a TODO.
diff --git a/nix/templates/harness-base.nix b/nix/templates/harness-base.nix
index e2d855b4..62fa305c 100644
--- a/nix/templates/harness-base.nix
+++ b/nix/templates/harness-base.nix
@@ -353,7 +353,6 @@
     # fail inside the container. Enable sandbox-fallback so builds that
     # can't set up the sandbox (no user-namespaces in nspawn) fall back
     # to unsandboxed local builds rather than failing outright.
-    # Security implications: see docs/security.md.
     nix.settings.sandbox-fallback = true;
 
     # `claude-code` is unfree. Each per-agent container's nixosConfiguration