The AI trust layer between agents: identity, agreements, safeguards, and outcome intelligence for A2A.

Viewing files at commit 6450fe9d331dCommit details View latest

THREAT_MODEL.md 16 lines · 1.1 KB

Threat Model

Protected paths include:

Tampering: canonical signed objects and independent verification.
Replay: unique nonces plus timestamp and expiry checks.
Delegation escalation: child scopes must be a subset of active parent authority.
Revocation/rotation: key and credential IDs bind signatures to active agent versions.
Duplicate events: same ID with different content is rejected.
Prompt injection: untrusted text never changes deterministic policy decisions.
Sensitive logging: configured field redaction and structured logging only.
Evidence URLs: production providers must enforce HTTPS, allowlists, size limits, redirects, and timeouts.
Review manipulation: only receipt-linked signed feedback affects profiles; future hosted systems add operator correlation, burst, ring, and collusion detection.
Version impersonation: envelopes, events, receipts, and profiles bind agent version.

MVP limitations: local key files are not HSM-backed; identity associations are demonstrations; advanced URL fetching and production fraud models are deferred.

# Threat Model

Protected paths include:

- Tampering: canonical signed objects and independent verification.
- Replay: unique nonces plus timestamp and expiry checks.
- Delegation escalation: child scopes must be a subset of active parent authority.
- Revocation/rotation: key and credential IDs bind signatures to active agent versions.
- Duplicate events: same ID with different content is rejected.
- Prompt injection: untrusted text never changes deterministic policy decisions.
- Sensitive logging: configured field redaction and structured logging only.
- Evidence URLs: production providers must enforce HTTPS, allowlists, size limits, redirects, and timeouts.
- Review manipulation: only receipt-linked signed feedback affects profiles; future hosted systems add operator correlation, burst, ring, and collusion detection.
- Version impersonation: envelopes, events, receipts, and profiles bind agent version.

MVP limitations: local key files are not HSM-backed; identity associations are demonstrations; advanced URL fetching and production fraud models are deferred.

1	`# Threat Model`
2
3	`Protected paths include:`
4
5	`- Tampering: canonical signed objects and independent verification.`
6	`- Replay: unique nonces plus timestamp and expiry checks.`
7	`- Delegation escalation: child scopes must be a subset of active parent authority.`
8	`- Revocation/rotation: key and credential IDs bind signatures to active agent versions.`
9	`- Duplicate events: same ID with different content is rejected.`
10	`- Prompt injection: untrusted text never changes deterministic policy decisions.`
11	`- Sensitive logging: configured field redaction and structured logging only.`
12	`- Evidence URLs: production providers must enforce HTTPS, allowlists, size limits, redirects, and timeouts.`
13	`- Review manipulation: only receipt-linked signed feedback affects profiles; future hosted systems add operator correlation, burst, ring, and collusion detection.`
14	`- Version impersonation: envelopes, events, receipts, and profiles bind agent version.`
15
16	`MVP limitations: local key files are not HSM-backed; identity associations are demonstrations; advanced URL fetching and production fraud models are deferred.`