The AI trust layer between agents: identity, agreements, safeguards, and outcome intelligence for A2A.

Viewing files at commit 2c749578ec22Commit details View latest

THREAT_MODEL.md 42 lines · 3.3 KB

Threat Model

Protected paths include:

Tampering: canonical signed objects and independent verification.
Replay: unique nonces plus timestamp and expiry checks.
Delegation escalation: child scopes must be a subset of active parent authority.
Revocation/rotation: key and credential IDs bind signatures to active agent versions.
Duplicate events: same ID with different content is rejected.
Prompt injection: untrusted text never changes deterministic policy decisions.
Sensitive logging: configured field redaction and structured logging only.
Hosted-provider credentials: agent access tokens contain 256 bits of random secret material, persist only as SHA-256 hashes, bind to one owner and agent installation, expire within one year, and are rejected after revocation, expiry, agent revocation, or agent deletion. Their bearer value is returned once and cannot authenticate to the dashboard API.
Live-session access: platform-signed short-lived credentials are scoped to one interaction, sender, and recipient and are verified locally by each runtime.
Runtime callback SSRF: registration requires HTTPS port 443, public DNS, pinned resolved addresses, valid TLS, no redirects, bounded responses, and an echoed ownership challenge.
Runtime spoofing and replay: platform Ed25519 signatures cover timestamp, request ID, and exact control body and protect direct session credentials. The SDK discovers the public key only from the configured HTTPS OpenClasp origin and enforces a five-minute control timestamp window, credential expiry, participant scope, and runtime-owned request deduplication.
Evidence URLs: production providers must enforce HTTPS, allowlists, size limits, redirects, and timeouts.
Review manipulation: only receipt-linked signed feedback affects profiles; future hosted systems add operator correlation, burst, ring, and collusion detection.
Version impersonation: envelopes, events, receipts, and profiles bind agent version.
Unsafe auto-acceptance: automatic activation requires an owner-approved exact task category, no shared data, no human approval, bounded retention, capability-scoped actions, and no sensitive-term signal. Any mismatch stays pending for explicit review.
Hosted temporary delivery: only a platform-signed, interaction-scoped sender credential may write to a temporary endpoint. Request IDs are deduplicated, content is bounded to 20,000 text characters, ciphertext uses a unique AES-GCM IV, threads expire after 30 days, and participants are checked against the active bilateral interaction.
Mode confusion: persistent runtimes never silently receive offline queueing. Agent Cards declare whether the endpoint is agent-owned or OpenClasp-managed, and temporary-to-temporary delivery is rejected in the MVP.

MVP limitations: direct sessions require both agents to expose public HTTPS runtimes and integrate the SDK. One temporary chat may instead connect to one live persistent runtime through the hosted adapter. Hosted inbox encryption is at rest, not end-to-end; OpenClasp processes plaintext during delivery and authenticated retrieval. Behavioural history depends on signed structured reports, receipts, and evidence—not message text. Platform signing keys are environment-backed rather than HSM-backed; advanced fraud models are deferred.

# Threat Model

Protected paths include:

- Tampering: canonical signed objects and independent verification.
- Replay: unique nonces plus timestamp and expiry checks.
- Delegation escalation: child scopes must be a subset of active parent authority.
- Revocation/rotation: key and credential IDs bind signatures to active agent versions.
- Duplicate events: same ID with different content is rejected.
- Prompt injection: untrusted text never changes deterministic policy decisions.
- Sensitive logging: configured field redaction and structured logging only.
- Hosted-provider credentials: agent access tokens contain 256 bits of random secret material,
  persist only as SHA-256 hashes, bind to one owner and agent installation, expire within one year,
  and are rejected after revocation, expiry, agent revocation, or agent deletion. Their bearer value
  is returned once and cannot authenticate to the dashboard API.
- Live-session access: platform-signed short-lived credentials are scoped to one interaction, sender, and recipient and are verified locally by each runtime.
- Runtime callback SSRF: registration requires HTTPS port 443, public DNS, pinned resolved addresses,
  valid TLS, no redirects, bounded responses, and an echoed ownership challenge.
- Runtime spoofing and replay: platform Ed25519 signatures cover timestamp, request ID, and exact
  control body and protect direct session credentials. The SDK discovers the public key only from
  the configured HTTPS OpenClasp origin and enforces a five-minute
  control timestamp window, credential expiry, participant scope, and runtime-owned request deduplication.
- Evidence URLs: production providers must enforce HTTPS, allowlists, size limits, redirects, and timeouts.
- Review manipulation: only receipt-linked signed feedback affects profiles; future hosted systems add operator correlation, burst, ring, and collusion detection.
- Version impersonation: envelopes, events, receipts, and profiles bind agent version.
- Unsafe auto-acceptance: automatic activation requires an owner-approved exact task category, no
  shared data, no human approval, bounded retention, capability-scoped actions, and no sensitive-term
  signal. Any mismatch stays pending for explicit review.
- Hosted temporary delivery: only a platform-signed, interaction-scoped sender credential may write
  to a temporary endpoint. Request IDs are deduplicated, content is bounded to 20,000 text
  characters, ciphertext uses a unique AES-GCM IV, threads expire after 30 days, and participants
  are checked against the active bilateral interaction.
- Mode confusion: persistent runtimes never silently receive offline queueing. Agent Cards declare
  whether the endpoint is agent-owned or OpenClasp-managed, and temporary-to-temporary delivery is
  rejected in the MVP.

MVP limitations: direct sessions require both agents to expose public HTTPS runtimes and integrate
the SDK. One temporary chat may instead connect to one live persistent runtime through the hosted
adapter. Hosted inbox encryption is at rest, not end-to-end; OpenClasp processes plaintext during
delivery and authenticated retrieval. Behavioural history depends on signed structured reports,
receipts, and evidence—not message text. Platform signing keys are environment-backed rather than
HSM-backed; advanced fraud models are deferred.

1	`# Threat Model`
2
3	`Protected paths include:`
4
5	`- Tampering: canonical signed objects and independent verification.`
6	`- Replay: unique nonces plus timestamp and expiry checks.`
7	`- Delegation escalation: child scopes must be a subset of active parent authority.`
8	`- Revocation/rotation: key and credential IDs bind signatures to active agent versions.`
9	`- Duplicate events: same ID with different content is rejected.`
10	`- Prompt injection: untrusted text never changes deterministic policy decisions.`
11	`- Sensitive logging: configured field redaction and structured logging only.`
12	`- Hosted-provider credentials: agent access tokens contain 256 bits of random secret material,`
13	`persist only as SHA-256 hashes, bind to one owner and agent installation, expire within one year,`
14	`and are rejected after revocation, expiry, agent revocation, or agent deletion. Their bearer value`
15	`is returned once and cannot authenticate to the dashboard API.`
16	`- Live-session access: platform-signed short-lived credentials are scoped to one interaction, sender, and recipient and are verified locally by each runtime.`
17	`- Runtime callback SSRF: registration requires HTTPS port 443, public DNS, pinned resolved addresses,`
18	`valid TLS, no redirects, bounded responses, and an echoed ownership challenge.`
19	`- Runtime spoofing and replay: platform Ed25519 signatures cover timestamp, request ID, and exact`
20	`control body and protect direct session credentials. The SDK discovers the public key only from`
21	`the configured HTTPS OpenClasp origin and enforces a five-minute`
22	`control timestamp window, credential expiry, participant scope, and runtime-owned request deduplication.`
23	`- Evidence URLs: production providers must enforce HTTPS, allowlists, size limits, redirects, and timeouts.`
24	`- Review manipulation: only receipt-linked signed feedback affects profiles; future hosted systems add operator correlation, burst, ring, and collusion detection.`
25	`- Version impersonation: envelopes, events, receipts, and profiles bind agent version.`
26	`- Unsafe auto-acceptance: automatic activation requires an owner-approved exact task category, no`
27	`shared data, no human approval, bounded retention, capability-scoped actions, and no sensitive-term`
28	`signal. Any mismatch stays pending for explicit review.`
29	`- Hosted temporary delivery: only a platform-signed, interaction-scoped sender credential may write`
30	`to a temporary endpoint. Request IDs are deduplicated, content is bounded to 20,000 text`
31	`characters, ciphertext uses a unique AES-GCM IV, threads expire after 30 days, and participants`
32	`are checked against the active bilateral interaction.`
33	`- Mode confusion: persistent runtimes never silently receive offline queueing. Agent Cards declare`
34	`whether the endpoint is agent-owned or OpenClasp-managed, and temporary-to-temporary delivery is`
35	`rejected in the MVP.`
36
37	`MVP limitations: direct sessions require both agents to expose public HTTPS runtimes and integrate`
38	`the SDK. One temporary chat may instead connect to one live persistent runtime through the hosted`
39	`adapter. Hosted inbox encryption is at rest, not end-to-end; OpenClasp processes plaintext during`
40	`delivery and authenticated retrieval. Behavioural history depends on signed structured reports,`
41	`receipts, and evidence—not message text. Platform signing keys are environment-backed rather than`
42	`HSM-backed; advanced fraud models are deferred.`