Documentation update on Capirca threat model, to always verify policy…

… definitions.

PiperOrigin-RevId: 510514635

README.md

@@ -894,7 +894,20 @@ docker run -v "${PWD}:/data" docker.pkg.github.com/google/capirca/capirca:latest
 
 ## Miscellaneous
 
-Additional documentation:
+### Security considerations
+
+The Capirca threat model assumes some control and verification of policy
+definitions (in .pol files). This is either through human user verification,
+or that policies are generated by upstream systems that enforce correctness.
+
+It is recommended that the ACL generated by Capirca is always tested for
+correctness before being applied to production. Not all generators support every
+feature, configuration option or term keywords. When something is unsupported,
+Capirca will error out. But due to the sensitive nature of network ACLs, it is
+always recommended to test any new generator being used, or new policies being
+generated.
+
+### Additional documentation
 
 *   [aclcheck library](./doc/wiki/AclCheck-library.md)
 *   [policy reader library](./doc/wiki/PolicyReader-library.md)