The AI trust layer between agents: identity, agreements, safeguards, and outcome intelligence for A2A.

Viewing files at commit 989559e001cdCommit details View latest

THREAT_MODEL.md 27 lines · 2.0 KB

Threat Model

Protected paths include:

Tampering: canonical signed objects and independent verification.
Replay: unique nonces plus timestamp and expiry checks.
Delegation escalation: child scopes must be a subset of active parent authority.
Revocation/rotation: key and credential IDs bind signatures to active agent versions.
Duplicate events: same ID with different content is rejected.
Prompt injection: untrusted text never changes deterministic policy decisions.
Sensitive logging: configured field redaction and structured logging only.
Gateway access: short-lived HMAC grants are scoped to one interaction, sender, and recipient.
Gateway storage: AES-256-GCM detects ciphertext tampering; acknowledgement deletes messages and a 24-hour TTL bounds exposure.
Runtime callback SSRF: registration requires HTTPS port 443, public DNS, pinned resolved addresses, valid TLS, no redirects, bounded responses, and an echoed ownership challenge.
Runtime spoofing and replay: HMAC signatures cover timestamp, delivery ID, and exact body; the SDK enforces a five-minute timestamp window. Runtimes must durably deduplicate delivery IDs.
Evidence URLs: production providers must enforce HTTPS, allowlists, size limits, redirects, and timeouts.
Review manipulation: only receipt-linked signed feedback affects profiles; future hosted systems add operator correlation, burst, ring, and collusion detection.
Version impersonation: envelopes, events, receipts, and profiles bind agent version.
Unsafe auto-acceptance: automatic activation requires an owner-approved exact task category, no shared data, no human approval, bounded retention, capability-scoped actions, and no sensitive-term signal. Any mismatch stays pending for explicit review.

MVP limitations: gateway encryption is server-side rather than end-to-end; an online OpenClasp function sees plaintext while accepting or delivering a message. MCP clients poll the inbox and cannot wake an offline agent. Local key files are not HSM-backed; advanced fraud models are deferred.

# Threat Model

Protected paths include:

- Tampering: canonical signed objects and independent verification.
- Replay: unique nonces plus timestamp and expiry checks.
- Delegation escalation: child scopes must be a subset of active parent authority.
- Revocation/rotation: key and credential IDs bind signatures to active agent versions.
- Duplicate events: same ID with different content is rejected.
- Prompt injection: untrusted text never changes deterministic policy decisions.
- Sensitive logging: configured field redaction and structured logging only.
- Gateway access: short-lived HMAC grants are scoped to one interaction, sender, and recipient.
- Gateway storage: AES-256-GCM detects ciphertext tampering; acknowledgement deletes messages and a 24-hour TTL bounds exposure.
- Runtime callback SSRF: registration requires HTTPS port 443, public DNS, pinned resolved addresses,
  valid TLS, no redirects, bounded responses, and an echoed ownership challenge.
- Runtime spoofing and replay: HMAC signatures cover timestamp, delivery ID, and exact body; the SDK
  enforces a five-minute timestamp window. Runtimes must durably deduplicate delivery IDs.
- Evidence URLs: production providers must enforce HTTPS, allowlists, size limits, redirects, and timeouts.
- Review manipulation: only receipt-linked signed feedback affects profiles; future hosted systems add operator correlation, burst, ring, and collusion detection.
- Version impersonation: envelopes, events, receipts, and profiles bind agent version.
- Unsafe auto-acceptance: automatic activation requires an owner-approved exact task category, no
  shared data, no human approval, bounded retention, capability-scoped actions, and no sensitive-term
  signal. Any mismatch stays pending for explicit review.

MVP limitations: gateway encryption is server-side rather than end-to-end; an online OpenClasp
function sees plaintext while accepting or delivering a message. MCP clients poll the inbox and
cannot wake an offline agent. Local key files are not HSM-backed; advanced fraud models are deferred.

1	`# Threat Model`
2
3	`Protected paths include:`
4
5	`- Tampering: canonical signed objects and independent verification.`
6	`- Replay: unique nonces plus timestamp and expiry checks.`
7	`- Delegation escalation: child scopes must be a subset of active parent authority.`
8	`- Revocation/rotation: key and credential IDs bind signatures to active agent versions.`
9	`- Duplicate events: same ID with different content is rejected.`
10	`- Prompt injection: untrusted text never changes deterministic policy decisions.`
11	`- Sensitive logging: configured field redaction and structured logging only.`
12	`- Gateway access: short-lived HMAC grants are scoped to one interaction, sender, and recipient.`
13	`- Gateway storage: AES-256-GCM detects ciphertext tampering; acknowledgement deletes messages and a 24-hour TTL bounds exposure.`
14	`- Runtime callback SSRF: registration requires HTTPS port 443, public DNS, pinned resolved addresses,`
15	`valid TLS, no redirects, bounded responses, and an echoed ownership challenge.`
16	`- Runtime spoofing and replay: HMAC signatures cover timestamp, delivery ID, and exact body; the SDK`
17	`enforces a five-minute timestamp window. Runtimes must durably deduplicate delivery IDs.`
18	`- Evidence URLs: production providers must enforce HTTPS, allowlists, size limits, redirects, and timeouts.`
19	`- Review manipulation: only receipt-linked signed feedback affects profiles; future hosted systems add operator correlation, burst, ring, and collusion detection.`
20	`- Version impersonation: envelopes, events, receipts, and profiles bind agent version.`
21	`- Unsafe auto-acceptance: automatic activation requires an owner-approved exact task category, no`
22	`shared data, no human approval, bounded retention, capability-scoped actions, and no sensitive-term`
23	`signal. Any mismatch stays pending for explicit review.`
24
25	`MVP limitations: gateway encryption is server-side rather than end-to-end; an online OpenClasp`
26	`function sees plaintext while accepting or delivering a message. MCP clients poll the inbox and`
27	`cannot wake an offline agent. Local key files are not HSM-backed; advanced fraud models are deferred.`