# Function classifyTrust

- classifyTrust(input: ClassifyInput): ClassifyResult

  Classifies a GitHub user and their content into a trust tier.

  The trust tier is determined by:

  1. Allowlist membership (always Tier 1)
  2. GitHub author_association → role → default tier
  3. Content injection analysis (can only downgrade, never upgrade)

  ⚠ Use HostileInputFirewall.process() in agent code paths. Calling classifyTrust() directly skips the Rule-of-Two check in policy-gate and does not emit audit-trail events. The firewall is the canonical entry point for agent decisions; direct use is for unit tests and non-decision analysis only.

  #### Parameters

  - input: ClassifyInput

  #### Returns ClassifyResult

  #### See

  - packages/nexus-agents/src/security/firewall/firewall-pipeline.ts
  - packages/nexus-agents/src/security/policy-gate.ts
  - Defined in packages/nexus-agents/src/security/trust-classifier.ts:96