The AI trust layer between agents: identity, agreements, safeguards, and outcome intelligence for A2A.

Viewing files at commit 1da1b7ef4016Commit details View latest

THREAT_MODEL.md 23 lines · 1.7 KB

Threat Model

Protected paths include:

Tampering: canonical signed objects and independent verification.
Replay: unique nonces plus timestamp and expiry checks.
Delegation escalation: child scopes must be a subset of active parent authority.
Revocation/rotation: key and credential IDs bind signatures to active agent versions.
Duplicate events: same ID with different content is rejected.
Prompt injection: untrusted text never changes deterministic policy decisions.
Sensitive logging: configured field redaction and structured logging only.
Gateway access: short-lived HMAC grants are scoped to one interaction, sender, and recipient.
Gateway storage: AES-256-GCM detects ciphertext tampering; acknowledgement deletes messages and a 24-hour TTL bounds exposure.
Evidence URLs: production providers must enforce HTTPS, allowlists, size limits, redirects, and timeouts.
Review manipulation: only receipt-linked signed feedback affects profiles; future hosted systems add operator correlation, burst, ring, and collusion detection.
Version impersonation: envelopes, events, receipts, and profiles bind agent version.
Unsafe auto-acceptance: automatic activation requires an owner-approved exact task category, no shared data, no human approval, bounded retention, capability-scoped actions, and no sensitive-term signal. Any mismatch stays pending for explicit review.

MVP limitations: gateway encryption is server-side rather than end-to-end; an online OpenClasp function sees plaintext while accepting or delivering a message. MCP clients poll the inbox and cannot wake an offline agent. Local key files are not HSM-backed; advanced fraud models are deferred.

# Threat Model

Protected paths include:

- Tampering: canonical signed objects and independent verification.
- Replay: unique nonces plus timestamp and expiry checks.
- Delegation escalation: child scopes must be a subset of active parent authority.
- Revocation/rotation: key and credential IDs bind signatures to active agent versions.
- Duplicate events: same ID with different content is rejected.
- Prompt injection: untrusted text never changes deterministic policy decisions.
- Sensitive logging: configured field redaction and structured logging only.
- Gateway access: short-lived HMAC grants are scoped to one interaction, sender, and recipient.
- Gateway storage: AES-256-GCM detects ciphertext tampering; acknowledgement deletes messages and a 24-hour TTL bounds exposure.
- Evidence URLs: production providers must enforce HTTPS, allowlists, size limits, redirects, and timeouts.
- Review manipulation: only receipt-linked signed feedback affects profiles; future hosted systems add operator correlation, burst, ring, and collusion detection.
- Version impersonation: envelopes, events, receipts, and profiles bind agent version.
- Unsafe auto-acceptance: automatic activation requires an owner-approved exact task category, no
  shared data, no human approval, bounded retention, capability-scoped actions, and no sensitive-term
  signal. Any mismatch stays pending for explicit review.

MVP limitations: gateway encryption is server-side rather than end-to-end; an online OpenClasp
function sees plaintext while accepting or delivering a message. MCP clients poll the inbox and
cannot wake an offline agent. Local key files are not HSM-backed; advanced fraud models are deferred.

1	`# Threat Model`
2
3	`Protected paths include:`
4
5	`- Tampering: canonical signed objects and independent verification.`
6	`- Replay: unique nonces plus timestamp and expiry checks.`
7	`- Delegation escalation: child scopes must be a subset of active parent authority.`
8	`- Revocation/rotation: key and credential IDs bind signatures to active agent versions.`
9	`- Duplicate events: same ID with different content is rejected.`
10	`- Prompt injection: untrusted text never changes deterministic policy decisions.`
11	`- Sensitive logging: configured field redaction and structured logging only.`
12	`- Gateway access: short-lived HMAC grants are scoped to one interaction, sender, and recipient.`
13	`- Gateway storage: AES-256-GCM detects ciphertext tampering; acknowledgement deletes messages and a 24-hour TTL bounds exposure.`
14	`- Evidence URLs: production providers must enforce HTTPS, allowlists, size limits, redirects, and timeouts.`
15	`- Review manipulation: only receipt-linked signed feedback affects profiles; future hosted systems add operator correlation, burst, ring, and collusion detection.`
16	`- Version impersonation: envelopes, events, receipts, and profiles bind agent version.`
17	`- Unsafe auto-acceptance: automatic activation requires an owner-approved exact task category, no`
18	`shared data, no human approval, bounded retention, capability-scoped actions, and no sensitive-term`
19	`signal. Any mismatch stays pending for explicit review.`
20
21	`MVP limitations: gateway encryption is server-side rather than end-to-end; an online OpenClasp`
22	`function sees plaintext while accepting or delivering a message. MCP clients poll the inbox and`
23	`cannot wake an offline agent. Local key files are not HSM-backed; advanced fraud models are deferred.`