THREAT_MODEL.md
36 lines · 2.7 KB
Threat Model
Protected paths include:
- Tampering: canonical signed objects and independent verification.
- Replay: unique nonces plus timestamp and expiry checks.
- Delegation escalation: child scopes must be a subset of active parent authority.
- Revocation/rotation: key and credential IDs bind signatures to active agent versions.
- Duplicate events: same ID with different content is rejected.
- Prompt injection: untrusted text never changes deterministic policy decisions.
- Sensitive logging: configured field redaction and structured logging only.
- Hosted-provider credentials: agent access tokens contain 256 bits of random secret material, persist only as SHA-256 hashes, bind to one owner and agent installation, expire within one year, and are rejected after revocation, expiry, agent revocation, or agent deletion. Their bearer value is returned once and cannot authenticate to the dashboard API.
- Live-session access: platform-signed short-lived credentials are scoped to one interaction, sender, and recipient and are verified locally by each runtime.
- Runtime callback SSRF: registration requires HTTPS port 443, public DNS, pinned resolved addresses, valid TLS, no redirects, bounded responses, and an echoed ownership challenge.
- Runtime spoofing and replay: platform Ed25519 signatures cover timestamp, request ID, and exact control body and protect direct session credentials. The SDK discovers the public key only from the configured HTTPS OpenClasp origin and enforces a five-minute control timestamp window, credential expiry, participant scope, and runtime-owned request deduplication.
- Evidence URLs: production providers must enforce HTTPS, allowlists, size limits, redirects, and timeouts.
- Review manipulation: only receipt-linked signed feedback affects profiles; future hosted systems add operator correlation, burst, ring, and collusion detection.
- Version impersonation: envelopes, events, receipts, and profiles bind agent version.
- Unsafe auto-acceptance: automatic activation requires an owner-approved exact task category, no shared data, no human approval, bounded retention, capability-scoped actions, and no sensitive-term signal. Any mismatch stays pending for explicit review.
- Message-path separation: OpenClasp brokers scoped session credentials and runtime endpoints but exposes no conversation relay or offline message queue. Public Agent Cards only advertise verified agent-owned runtimes.
MVP limitations: sessions require both agents to expose public HTTPS runtimes and integrate the SDK or a compatible connector. Behavioural history depends on signed structured reports, receipts, and evidence—not message text. Platform signing keys are environment-backed rather than HSM-backed; advanced fraud models are deferred.